Method and apparatus for compiling data relating to operation of an electronic lock system

ABSTRACT

A key is provided with a memory in which, without user intervention, it collects data relating to lock operations each time the key interacts with a lock. This data is subsequently downloaded from the key to a computer. In some embodiments, the keys collect data relating not just to their own transactions, but also poll lock memories for the locks&#39; prior transactions as well. By this arrangement, a patchwork collection of redundant data can be developed in the computer, improving data integrity and reducing data latency.

RELATED APPLICATION DATA

This application is a continuation-in-part of copending application192,834, now abandoned, filed May 11, 1988, which in turn is a divisionof copending application Ser. No. 015,864, filed Feb. 17, 1987, now Pat.No. 4,766,746, which in turn is a continuation-in-part of Ser. No.831,601, filed Feb. 21, 1986, now Pat. No. 4,727,368, which in turn is acontinuation-in-part of Ser. No. 814,364, filed Dec. 30, 1985, nowabandoned, which in turn is a continuation-in-part of Ser. No. 788,072,filed Oct. 16, 1985, now abandoned. These applications are incorporatedherein by reference.

BACKGROUND AND SUMMARY OF THE INVENTION

The present invention relates to real estate lockboxes and other secureentry systems. Lockboxes are used in the real estate industry to containthe keys of houses listed for sale. Prior art lockboxes have primarilybeen mechanical devices which allow access to a secure compartment byuse of a conventional key. Such lockboxes and keys, however, have hadnumerous disadvantages. These disadvantages have been overcome by thepresent invention and a great number of new features have been provided.

In accordance with the present invention, a key is provided with amemory in which, without user intervention, it collects data relating tolock operations each time the key interacts with a lock. This data issubsequently downloaded from the key to a computer.

In some embodiments, the keys collect data relating not just to theirown transactions, but also poll lock memories for the locks' priortransactions as well. By this arrangement, a patchwork collection ofredundant data can be developed in the computer, improving dataintegrity and reducing data latency.

The foregoing and additional features and advantages of the presentinvention will be more readily apparent from the following detaileddescription of a preferred embodiment thereof, which proceeds withreference to the accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 shows a lockbox, a key, a stand and a computer used in a lockboxsystem according to the present invention.

FIG. 2 is a rear view, partially in section, schematically illustratingportions of a lockbox according to the present invention.

Fig. 3 is a sectional view taken along line 3--3 of FIG. 2,schematically illustrating some of the locking components in a lockboxaccording to the present invention.

FIG. 4 is a top view of a shackle locking bar used in the lockbox ofFIGS. 2 and 3.

FIG. 5 is a rear elevational view of the shackle locking bar of FIG. 4.

FIG. 6 is a right side view of a door stem used in the lockbox of FIGS.2 and 3.

FIG. 7 is a front elevational view of a lockbox shackle used in thelockbox of FIGS. 2 and 3.

FIG. 8, is a sectional view of the case of the lockbox of FIGS. 2 and 3taken along line 8--8 of FIG. 2.

FIG. 9 is a schematic block diagram of the electronic circuitry used inthe lockbox of FIGS. 2 and 3.

FIG. 10 is a plan view of a key according to the present invention.

FIG. 11 is a left side view of the key of FIG 10.

FIG. 12 is a schematic block diagram of the electronic circuitry used inthe key shown in FIGS. 10 and 11.

FIG. 13 is a diagram illustrating portions of the electronic memoriesused by the lockbox and key of the present invention.

FIG. 14 is a top plan view of a remote stand according to the presentinvention.

FIG. 15 is a sectional view taken along lines 15--15 of FIG. 14 andshowing the stand with two different sizes of keys.

FIG. 16 is a sectional view taken along lines 16--16 of FIG. 14 andshowing the stand coupled to a lockbox.

FIG. 17 is a rear elevational view of the stand shown in FIG. 14.

FIG. 18a is a schematic block diagram of the electronic circuitry used alocal stand according to the present invention.

FIG. 18b is a schematic block diagram of the electronic circuitry usedin a remote stand according to the present invention.

FIG. l9 is a schematic block diagram showing a digital reconstructionmodulation system according to the present invention.

FIG. 20 shows a radio system for updating lockboxes and keys accordingto the present invention.

FIG. 21 shows a computer and trunk interface unit used in an enhancedversion of the system of FIG. 1.

FIG. 22 illustrates the memory contents of the two lockboxes A and B andthree keys (1, 2, and 3).

FIG. 23 illustrates a database into which the data collected by the keysis downloaded.

DETAILED DESCRIPTION OF A PREFERRED EMBODIMENT GENERAL OVERVIEW

A basic lockbox system 10 according to the present invention, shown inFIG. 1, includes one or more lockboxes, or keysafes, 12, electronic keys14, stands 16 and computers 18. Lockbox 12 contains the door key to thelisted dwelling and is mounted securely on or near the dwelling.Electronic key 14 is used by real estate agents to open the lockbox andgain access to the dwelling key contained therein. Key 14 can also beused to read access log data from the lockbox and to load programminginstructions into it. Stand 16 is used to interface computer 18 with thelockbox and key units. Computer 18 is used to store instructions in andto collect data from lockbox 12 and key 14 so as to integrate managementof a lockbox system.

LOCKBOX

With reference to FIGS. 2-3, lockbox 12 includes a secure enclosure, orhouse key compartment 20 designed to contain house keys, business cards,written messages and the like. Lockbox 12 is securely attached to thelisted house or other fixed object by a shackle 22 or by screws (notshown). Shackle 22 in most instances attaches the lockbox to a doorknob,water spigot or porch guard rail. Upon a proper exchange of signalsbetween lockbox 12 and key 14, a door 24 to the lockbox house keycompartment 20 can be opened, thereby allowing access to the house keyand to other materials stored inside.

The circuitry of lockbox 12 is shown in block diagram form in FIG. 9.Lockbox 12 includes a communications coil 26, a microprocessor (CPU) 28,a read/write (RAM) memory 30, a primary battery 32, a backup battery 34,a pair of key compartment locking solenoids 36, a pair of shacklelocking solenoids 38, a key compartment solenoid drive circuit 40, anassociated microswitch 42 and a shackle solenoid drive circuit 43.

Communications coil 26 is used to electromagnetically couple tocorresponding coils in key 14 and stand 16. Microprocessor 28 controlsoperation of lockbox 12 according to programming instructions ("lockboxcontrol software") permanently stored in a associated read only memory(ROM) 44. RAM memory 30 is used to store various elements and strings ofoperating data. Primary battery 32 provides power to the lockboxcircuitry. Backup battery 34 is used when the primary battery becomesweak or is removed for replacement. Key compartment locking solenoids 36releasably lock house key compartment door 24 under the control of doorsolenoid drive circuit 40 and microswitch 42. Shackle locking solenoids38 releasably lock shackle 22 under the control of shackle solenoiddrive circuit 43.

Although illustrated as a single component, lockbox CPU 28 is in facttwo discrete microprocessor circuits. The first, a NationalSemiconductor 820 Series Control Oriented Processor, is an eight bitprocessor that performs all control, communications and logic functionswith the exception of timing and calendar-clock functions. Thesefunctions are performed by a National Semiconductor COP 498 processorwhich is mask programmed by the manufacturer to perform a variety oftime keeping functions. The lockbox RAM 30 is comprised of a low power,low voltage Toshiba LC3517NC RAM circuit, which is organized as 2048eight bit bytes.

Lockbox CPU 28 stores information on certain of the operations that areexecuted, or attempted to be executed, by a key or the lockbox in aportion of RAM memory 30 termed the "access log." Each entry in theaccess log includes the identity of the key, the date and time of theoperation (obtained from the calendar-clock portion of CPU 28), thefunction attempted and, if the function was denied, the reason why. Inthe illustrated exemplary embodiment, the lockbox access log can storeinformation on 100 lockbox operations. This log can later be retrieved,in whole or in part, by key 14 or by stand 16 for transfer to computer18 or for display on a CRT screen or printer.

Management of the lockbox access log is performed by lockbox CPU 28 inconjunction with a "roll flag" and a "pointer"stored in lockbox RAM 30.The roll flag indicates whether all 100 entries in the access log havebeen filled and consequently whether the memory is recycling,overwriting old data. The pointer indicates the address of the memorylocation at which the next access log entry will be stored.

When the lockbox is initialized (discussed below in the section entitledInitialization and Deactivation of Lockboxes and Keys by the Computer),the roll flag is set to "0" and the pointer is set to indicate theaddress of the first memory location in the access log. Thereafter, eachentry in the log causes the pointer to increment to the address of thenext memory location in the log.

After 100 entries have been stored in the access log, the pointerrecycles and indicates again the address of the first memory location inthe access log. At this point, the rollover flag is set to "1,"indicating that the access log has become a circular data buffer andthat each additional entry will overwrite an earlier entry.

Lockbox Characterization Instructions

Lockbox 12 is characterized by "lockbox characterization instructions"loaded into lockbox RAM memory 30 by a computer through a stand. (Key 14can also be used to load a set of limited characterization instructionsinto lockbox RAM memory 30, as discussed below in the section entitledFunctions). The lockbox characterization instructions give the lockboxan identity, fix in it certain numerical values and enable it to performcertain functions.

As shown in the illustrative lockbox memory map in FIG. 13, theidentification information loaded with the characterization instructionsidentifies the listing, the listing agent, the responsible agency andthe responsible board. The identification information further identifiesthe lockbox by a unique lockbox serial number.

Some of the numerical values loaded into the lockbox include a "Shown ByArrangement"(SBA) number, a key lockout list and a collection of lockboxaccess codes.

Functions enabled by function enable bits in the characterizationinstructions may include Lockbox Disable On Removal and Privacy Read(both discussed below in the section entitled Programmable LockboxOptions).

After its initial characterization by stand 16, lockbox 12 will notrequire further maintenance or programming until the lockbox is moved toa new location.

Mechanical details of the lockbox 12 are discussed below in the sectionentitled Mechanical Construction of Lockbox.

KEY

With reference to FIGS. 10 and 11, key 14 is constructed in a trimpolycarbonate enclosure 46 sized to fit conveniently in a user's purseor pocket. The key includes a keypad 48 and an LCD display 50. Keypad 48is used to enter commands into the key. LCD display 50 is used todisplay instructions and information to the user.

LCD display 50 includes a central message portion in which messages fromthe system can be displayed to the user. Display 50 also includes alower portion comprising a "prompt" field and an upper portioncomprising an "annunciator" field. The prompt field includes twelvepotential prompts which represent twelve functions that a user canrequest the key to execute. They are OPEN, SHACKLE RELEASE, CHANGEPERSONAL CODE, CONTROLLER, READ FILE MARK, READ NN, READ, CLEAR MEMORY,SIGNATURE, SHOWN BY ARRANGEMENT, FILE MARK, and PROGRAM. These functionsare discussed below in the section entitled Functions.

The annunciator field includes five potential annunciators whichindicate the status of various aspects of the key. The annunciators inthe preferred embodiment are FUNCTION, READ, PROGRAM, KEYSAFE BATTERYand KEY BATTERY.

The READ annunciator is made visible when the key contains lockboxaccess log data transferred from a lockbox during a READ operation. ThePROGRAM annunciator is made visible when the key contains a set oflimited characterization instructions that are to be loaded into alockbox. The FUNCTION annunciator is made visible when the user is toselect a function to be executed. The KEYSAFE BATTERY and the KEYBATTERY annunciators are made visible when the batteries for theserespective units need attention.

The circuitry of key 14 is shown in block diagram form in FIG. 12. Key14 includes a communications coil 54, a key microprocessor (CPU) 52, thekeypad or other switch mechanism 48, the LCD display 50, a read/writememory (RAM) 56, a primary battery 58, a backup battery 60 and a beeper62.

Communications coil 54 is used to electromagnetically couple to thecorresponding coils in lockbox 12 and stand 16. Microprocessor 52controls operation of key 14 according to programming instructions ("keycontrol software") permanently stored in an associated read only memory(ROM) 64. RAM memory 56 again comprises a Toshiba LC3517NC RAM circuitand is used to store various elements and strings of operating data.Primary battery 58 provides power to the key circuitry. Backup battery60 is used when the primary battery becomes weak or is removed forreplacement. Beeper 62 beeps to call the user's attention to the key ina variety of instances, such as when an error is committed or when thekey and lockbox have successfully completed an operation.

Although illustrated as a single component, key CPU 52 also comprisestwo discrete microprocessor circuits. The first, a NationalSemiconductor 820 Series Control Oriented Processer, is an eight bitprocessor that performs all control, communications and logic functionsexcept reading data from keypad 48 and controlling operation of LCDdisplay 50 and beeper 62. These functions are performed by a very lowpower NEC uPD7501 4 bit microcontroller with an on board LCD driver. Thedistribution of processing tasks between two processors in this mannerreduces power consumption and increases operational efficiency byallocating the time consuming user interface chores to the very lowpower NEC processor, thereby allowing the logic functions to be morequickly performed using the higher power National processor.

Key Characterization Instructions

Key 14 is characterized by "key characterization instructions" loadedinto key RAM memory 56 by a computer through a stand. These instructionsgive the key an identity, fix in it certain numerical values and enableit to perform certain functions.

As shown in the illustrative key memory map in FIG. 13, theidentification information loaded with the characterization instructionsidentifies the agent, the responsible agency and the responsible board.The identification information further identifies the key by a uniqueserial number.

Some of the numerical values loaded with the key characterizationinstructions include a four digit personal code, permission codes forvarious of the functions and various key access codes with associatedexpiration dates.

Functions enabled by function enable bits in the characterizationinstructions may include OPEN, READ and SHACKLE RELEASE.

After its initial characterization by stand 16, key 14 will not requirefurther programming until any time dependent functions which may havebeen enabled, such as key expiration date or expiring key access codes(discussed below) need updating.

Limited Function Keys

This key described above can, if loaded with the proper characterizationinstructions, execute the entire complement of functions available onthe system, here illustrated as twelve. In some applications, however,it is desirable to provide simpler keys which can effect only a limitedrange of functions. Thus, it may be desirable, for example, to providekeys that can perform just three functions: open a lockbox, drop ashackle and communicate with a computer. Such a simple key could beconstructed without an LCD display.

Limiting the functions that a key can perform can be effected by settingcertain enable/disable bits in key RAM memory 56. In the preferredembodiment, key RAM memory 56 has an enable/disable data bitcorresponding to each of the twelve functions. If the enable/disabledata bit corresponding to a function is set to a "1," the function isenabled. If set to a "0," the function is disabled.

The enable/disable data in key RAM memory 56 is desirably set by themanufacturer so as to enable a particular set of functions. Thisarrangement permits the manufacturer to provide a variety of differentkeys to users having a variety of different requirements without theneed to tool up a separate manufacturing line for each different key. Ifthe manufacturer later wishes to change a key's enable/disable data, itcan do so by reprogramming the this data itself or by providing softwareto the responsible real estate board that will enable the board computerto reprogram this data.

In an alternative embodiment, key RAM memory 56 can have two data bitscorresponding to each of the twelve functions. One of these bits is setby the manufacturer to a "0" or a "1" and cannot be altered by the user.The other of these bits can be set to a "0" or a "1" by the authoritythat exercises supervisory control over the key, usually the local realestate board. In this alternative embodiment, the only functions thatare enabled are those for which corresponding enable/disable data bitshave both been set to a "1" by the appropriate authority. By thisalternative system, the local real estate board is empowered to tailorthe capabilities of its keys as it sees fit within the range offunctions enabled by the manufacturer.

Programmable Time Constants

In the preferred embodiment, all time constants in the both the lockboxand key are set by data bits stored in the respective units' RAMmemories (as illustrated by the lockbox and key memory maps of FIG. 13).These time constants set, for example, the length of time each of thetransient displays are maintained in LCD display 50 and the length oftime lockbox key compartment unlocking solenoids 36 are to be keptenergized.

STAND

Stand 16 is used in the present invention to transfer informationbetween computer 18 and the lockbox and key components of a lockboxsystem.

With reference to FIGS. 14-17, stand 16 can comprise an enclosure 66having a protrusion 68. Within protrusion 68 is a stand communicationscoil 70. In use, a key or a lockbox is positioned on stand 16 as shownin FIGS. 15 and 16, respectively. In these positions, the communicationscoil within the lockbox or key is positioned in proximity with standcommunications coil 70 in protrusion 68, thereby establishingelectromagnetic coupling between such coils.

In alternative embodiments, protrusion 68 can be omitted. In suchembodiments, communications coil 70 can be disposed within enclosure 66so that it is adjacent the coils in corresponding lockbox or key unitswhen such units are placed on the stand.

As illustrated in FIGS. 18a and 18b, stand 16 is constructed in twoforms. A first form of the stand, termed a local stand 16a, is designedto communicate with a computer at the same site. Local stands are thusintended for use at the board office, where they are tied directly tothe board computer, or at agency offices, where they may be tieddirectly to a smaller computer.

The second form of stand, termed a remote stand 16b, is a portable unitdesigned to communicate with a remote computer over conventionaltelephone lines. Remote stands 16b are thus typically used at agencyoffices that are not equipped with their own computers. Their portablenature, however, allows remote stands to be used wherever there is aphone line, such as at a property listed for sale, thereby enabling anagent to retrieve data from the board computer and provide a homeownerimmediate information about listing activity.

With reference to FIGS. 17, 18a and 18b, both forms of stand 16 includea microprocessor (CPU) 78, an associated read only memory 80, aread/write memory (RAM) 82 and a connector 83 for connection to a lowvoltage D.C. power supply. Local stand 16a further includes a cableconnector 72 for connection to the local computer. Remote stand 16bfurther includes a modem 74 and two modular phone jacks 76, 77 forinterfacing to a telephone line. First phone jack 76 is used to connectto the outgoing phone line. Second phone jack 77 is used to connect to aconventional telephone (not shown) which provides dialing signals on theoutgoing phone line. Remote stand 16b also includes a printer outputport 79 for interfacing to a printer. This printer is driven by theremote computer through the stand and permits hard copy display of thedata at the agency office or at the remote site at which the stand isused even though a computer is not locally available.

Desirably, CPU 78 comprises an Intel 8051 Series microprocessor and RAM82 comprises a NEC uPD4364 8192 by 8 bit static RAM.

In order to ensure data security, stand 16 desirably encrypts thelockbox and key data before it is sent to the computer. Conversely,stand 16 decrypts the computer data before it is sent to the lockbox andkey. This encryption/decryption is effected by microprocessor 78 inconjunction with read only memory 80 and read/write memory 82. ROMmemory 80 contains the encryption and decryption algorithms used bystand 16 in communicating with computer 18. RAM memory 82 is used fortemporary storage of data used in this process.

The encryption algorithms employed are such that if the same data isexchanged between stand 16 and computer 18 several times, the severaltransmissions will bear no resemblance to one another. Decryption byunauthorized eavesdroppers is thus deterred.

In the preferred embodiment, the data exchanged between stand 16 and thelockbox and key components is also similarly encrypted.

Stand Functions

Stand 16 can perform a variety of functions in the present invention.First, stand 16 can provide a complete set of new characterizationinstructions for lockbox 12 or key 14, or can simply modify an existingset of instructions. This is done by placing the key or lockbox on stand16, as illustrated in FIGS. 15 and 16, and executing arecharacterization program on computer 18. The recharacterizationprogram executed on computer 18 interrogates the user, using a menudisplay format on the computer screen, as to which functions are to beenabled, what constants are to be loaded, etc. The characterizationinstructions generated by the recharacterization program are thentransferred from the computer through the stand to the key or lockbox,where they are stored in RAM memory.

A set of limited recharacterization instructions for lockbox 12 canalternatively be loaded from stand 16 into key 14 for later relaying bythe key into the lockbox by using the PROGRAM function (discussed belowin the section entitled Functions).

The second function stand 16 can perform is to retrieve data, such aslockbox access log data, from the lockbox or the key and to relay it tocomputer 18. This is accomplished by positioning lockbox 12 or key 14 onstand 16 and executing an appropriate program, this time a dataretrieval program, on computer 18.

Stand 16 can also be used for a variety of other purposes, such as forrelaying diagnostic maintenance log data (discussed below in the sectionentitled Diagnostic Features) from the key or lockbox to the computerand for synchronizing the calendar-clock portion of lockbox CPU 28 withthe master calendar-clock maintained by computer 18.

One important feature provided by stand 16 is that it allows datatransfers to and from the key and lockbox components without the need totake such components back to a central control computer at the realestate board office. In large metropolitan areas, such as Houston, thelocal real estate board may encompass several thousand square miles.Consequently, it is highly undesirable to require that lockboxes andkeys be taken back to the board office every time an exchange of data isdesired. The relatively inexpensive stands of the present invention canbe distributed throughout the board's territory and can be used toeffect all data transfers. Desirably, most of the agency offices withinthe real estate board would have such a unit and several additionalunits would be available for portable use within the board's territory.

OPERATION

To operate the lockbox system, the user first energizes, or wakes up,key 14 by pushing an ON/CLEAR button on keypad 48. Beeper 62 beeps toconfirm that the key is energized. The key then displays the word "CODE"in the message portion of LCD display 50 in blinking form. The user thenhas a fixed time period, such as one minute, within which to enter afour digit personal code. As each digit of the personal code is entered,an asterisk appears in LCD display 50. The asterisks maintain theprivacy of the personal code while indicating the number of digitsentered. If no personal code is entered within the one minute timeperiod, key CPU 52 causes the key to become deenergized, or return tosleep, again. If the four digit personal code entered by the usermatches the personal code stored in key RAM memory 56, the user isprompted to select a function.

If an improper four digit personal code is entered on keypad 48, key 14will not allow the user to select a function. The user can start overand try to enter the correct personal code. If, after four tries, theproper personal code has still not been entered, key CPU 52 causes thekey to enter a "personal code timeout" mode in which the key isdeactivated for a ten minute period and during which it will not allowany further personal codes to be entered.

After the four digit personal code has been successfully entered, theFUNCTION annunciator in the upper portion of LCD display 50 is madevisible, together with the prompts in the lower portion of the displayrepresenting the available functions. (Key CPU 52 causes the promptscorresponding to the functions that are not available, for example thosefunctions which have been disabled, to remain invisible in LCD display50). The top left-hand most prompt in the prompt field, normally theOPEN prompt, will be blinking. It is the blinking prompt that indicateswhich function will be executed if the SELECT button is pressed.

Movement of the blinking feature in the LCD prompt display is controlledby the RIGHT SCROLL and LEFT SCROLL buttons on keypad 48. The RIGHTSCROLL button causes the blinking feature to move one prompt to theright, for example, from OPEN to SHACKLE RELEASE. When the right-mostprompt in a display line is blinking and the RIGHT SCROLL button ispressed, the blinking feature is moved to the left-most prompt in thefollowing line. The LEFT SCROLL button moves the blinking feature in theopposite direction in a similar fashion.

After the personal code has been entered successfully, it is the OPENprompt that blinks. Consequently, to open the lockbox, which is the mostcommon operation, the SCROLL buttons need not be operated at all.Instead, the SELECT button is simply pressed and the lockbox can beopened.

Once the SELECT button is pressed, CPU 52 causes all of the prompts tobe made invisible, except the selected prompt, which is caused to stayon continuously, not blinking

When the personal code has been successfully entered and a function hasbeen selected, key 14 is termed "armed" In the armed state, the keysends out a signal, termed here a characteristic interrogation pulsetrain, and seeks to couple with a lockbox. When the key is ultimatelycoupled with a lockbox, the electromagnetic pulses radiated by the keyinduce a voltage in the lockbox communications coil The induction ofthis voltage in the lockbox signals the lockbox to wake up. The lockboxthen responds by transmitting a second signal back to the key, asdiscussed below in the section entitled Authorization of LockboxFunctions.

When the OPEN feature has been selected, the four letter message fieldin the middle of LCD display 50 displays the word "SAFE" (short forkeysafe) in blinking form. (A blinking message in the message portion ofthe display demands an action by the user. A solid display in themessage portion indicates that the key is finished with the function).When the "SAFE" message is blinking in the message portion of thedisplay, the user has approximately ten minutes within which to engage akey with the lockbox.

Once the key and lockbox are successfully coupled, the message display,instead of displaying the "SAFE" message in blinking form, displays a"WAIT"message in solid form. This indicates to the user that the key andlockbox are coupled and are communicating. During the "WAIT" state,various data is exchanged between the key and the lockbox and each ofthe microprocessors is making various decisions as to whether toauthorize execution of the selected function (as described below in thesection entitled Authorization of Lockbox Functions). Finally, theprocessors decide, either together, or one informs the other, that theselected operation can be executed.

After the requisite exchange of data between key and lockbox hassuccessfully been completed and the requested function has beenexecuted, the message in key LCD display 50 changes from "WAIT" to"GOOD." The "GOOD" message is displayed whenever any operation issuccessfully completed. The successful execution of the function is alsoconfirmed audibly by beeper 62. The "GOOD" display is maintained forapproximately eight seconds. The key then displays the KEYSAFE BATTERYannunciator if the lockbox battery is low (discussed below in thesection entitled Battery Systems) and then returns to sleep.

If a user arms a key and then fails to complete the selected operationwith a lockbox, the key eventually goes into an error condition. Beeper62 beeps and an appropriate error code is displayed in the messagedisplay. The key then returns to sleep after displaying the errormessage for a predetermined time period.

One important feature of the invention is that the key strokes necessaryto request a function need not be entered while the key is coupled tothe lockbox. As indicated, key 14 must be held near lockbox 12 in orderfor the units to communicate. Although not usually a problem, this taskis sometimes difficult when the lockbox is mounted in a dark or awkwardlocation, such as on a water spigot mounted at ground level. In someembodiments, the user would need to engage the key with the lockbox insuch position and then start pressing buttons on keypad 48 correspondingto the required personal code and the desired function.

To obviate this potential problem, the key control software allows thekey to be armed in advance to request execution of a desired function.The key can then be mated momentarily with the lockbox and thehandshaking signal exchanges made automatically when the lockbox detectsthe key's characteristic interrogation signal. Thus, the user need notpress a single key in the dark or cramped location in which the key andlockbox may be mated in order to operate the lockbox. The personal codecan be entered and the desired function selected in a convenient,well-lit location, such as in a car. The agent then has a fixed period,such as ten minutes, within which to use the armed key to operate thelockbox. After this period, the key disarms itself so as to maintainsystem security.

In addition to providing a convenience to the user, the ability of thekey to be armed at a remote location and later coupled with the lockboxto execute a function also provides an important security benefit. Thatis, it allows the key to be armed away from prying eyes so as tomaintain the secrecy of the user's personal code.

FUNCTIONS Open

To open house key compartment 20 in lockbox 12, the user enters the fourdigit personal code on key 14, thereby causing the OPEN prompt in LCDdisplay 50 to blink. The SELECT button is then pressed and an exchangeof authorization signals between the lockbox and key is begun once theunits are successfully coupled. If the lockbox and key determine thatthe function is authorized, lockbox CPU 28 allows key compartment door24 to be opened.

In the preferred embodiment, key compartment door 24 does not pop openwhen the exchange of signals has been completed successfully. Instead, apress-to-open mechanism is provided on the door. After the appropriatesignals have been exchanged, the user presses door 24 inwardly and thenreleases. The door then pops open to reveal the contents of compartment20.

If the user does not open the press-to-open door within a predeterminedperiod of time, such as sixty seconds, the lockbox reverts to itspowered down, locked state.

In order to conserve lockbox battery power, key compartment unlockingsolenoids 36 are not energized until the user presses the press-to-opendoor. To effect this power savings, lockbox 12 is provided with amicroswitch 42 connected in key compartment solenoid drive circuit 40 sothat when door 24 is pressed in, the microswitch is engaged and closed.When door 24 is pressed in, CPU 28 detects the closure of microswitch 42and causes drive circuit 40 to then apply energy to key compartmentsolenoids 36 for a brief period. The solenoids retract, therebyunlocking door 24. The user then releases the door and it pops openunder the influence of a spring. The solenoids are thus not energizeduntil the user is actually ready to open the door. (The solenoids arearranged in lockbox 12 so that the inward pushing movement of keycompartment door 24 is allowed even when the solenoids are in theirlocked state).

After microswitch 42 is reopened by the door popping open, lockbox CPU28 waits approximately 0.25 seconds and then causes drive circuit 40 todeenergize the solenoids. It has been found that in a typical opening,the locking solenoids are energized for less than 0.5 seconds. Afterdeenergizing the solenoids, the lockbox returns to its sleeping state.

If door 24 is pressed in but is not released for more than 1.25 seconds,solenoids 36 are deenergized to secure the lockbox and the lockboxreturns to sleep.

In the preferred embodiment, key compartment door 24 is provided withtwo solenoids to enhance lockbox security. Each solenoid has a springloaded plunger. If only a single solenoid were used, the solenoid couldbe dislodged momentarily from its locking position by a sharp blow tothe lockbox The shock could propel the solenoid plunger momentarily toits retracted state, allowing door 24 to be opened.

In the preferred embodiment, two solenoids are used and are disposed sothat their plungers travel in opposite directions. If the lockbox issharply rapped so as to propel one solenoid plunger to its unlockedposition, the other solenoid plunger is propelled to its lockedposition.

In an alternative system using a single solenoid, a rotary solenoidcould be used. However, such an arrangement is less efficient and moreexpensive than the present system and also requires additional latchingcomponents.

Shackle Release

The shackle 22 or mounting bracket which secures lockbox 12 to astructure is, in the preferred embodiment, released on command from akey. By allowing real estate agents t administer lockboxes, rather thanjust real estate board employees, administration of large lockboxsystems is facilitated.

To release lockbox shackle 22, the user enters the four digit personalcode into the key and moves the blinking feature in the prompt field toSHACKLE RELEASE. The SELECT button is then pressed and a "SAFE" messagebegins blinking in key LCD display 50. After the lockbox and key arecoupled, these units exchange signals and, if these units decide that ashackle release is authorized, a "GOOD" message appears in LCD display50 and a shackle release is permitted.

In the preferred embodiment of the invention, the SHACKLE RELEASEfunction opens lockbox door 24. Actual release of the shackle is theneffected by movement of a press-to-release shackle locking stem 162(which is unlocked by shackle locking solenoids 38), which in turn movesa shackle locking bar 148 out of engagement with the shackle Like thekey compartment door arrangement, the shackle locking system also uses apair of reciprocally mounted solenoids to lock the shackle so as toenhance lockbox security.

Change Personal Code

When the user desires to change the four digit personal code, the CHANGEPERSONAL CODE function is used. The key is activated by the usualsequence of entering the four digit personal code and then moving theblinking feature in the prompt field until the CHANGE PERSONAL CODEprompt is blinking. When the SELECT button is pressed, the messagedisplay displays "NEW." The user then keys in the new four digitpersonal code that is to be substituted for the old code. Each time adigit of the new code is entered, an asterisk appears in the messageportion of display 50. After all four digits have been entered, the"NEW" message is displayed again. The user then reenters the new code.By this redundant technique, key CPU 52 double checks the new personalcode to insure that the user did not inadvertantly press a wrong key andthus enter a new personal code that was not intended and consequentlywould not be remembered.

After the successful entry of the new four digit personal code twice,the message display portion of LCD display 50 indicates "GOOD" toconfirm that the operation has been completed satisfactorily.

Controller

As discussed earlier, a stand is used to exchange data andcharacterization instructions between the key and the computer. One wayin which data can be exchanged between these units is simply to lay thesleeping key on the stand and press the ON/CLEAR button. The stand thencouples electromagnetically to the energized key and allows the key tocommunicate with the computer. However, for security reasons, it isdesirable that the computer not be allowed to perform the full range ofpossible functions on the key when the key is activated in this manner.An unauthorized user of a key could take the key and reprogram it if nofurther precautions were taken. Accordingly, it is desirable to limitthe functions that the key and computer can cooperate to perform whenthe key is merely energized by the ON/CLEAR button to a narrow group offunctions, such as running diagnostic routines and resetting the mastersoftware switch (discussed below). Thus the key will not permit newcharacterization instructions to be loaded.

In order for computer 18 to be allowed to perform its full complement offunctions on the key, the key must be activated in the CONTROLLER modeby an authorized user. To do this, the user enters the four digitpersonal code and moves the blinking feature in the prompt field toCONTROLLER. When the SELECT button is pressed, the key permits thecomputer to freely read from and write to the key within the limits setby ownership of the key (i.e. a computer cannot reprogram a key if thekey belongs to a different board).

Arming the key in the CONTROLLER mode is the only instance in which thekey does not send out its characteristic interrogation pulse train.Instead, the key listens for data or instructions relayed from thestand.

File Mark

Skipping ahead in the key's prompt field somewhat, the FILE MARKfunction is selected to put a mark in the access log maintained by thelockbox. As noted, the illustrative access log maintained in RAM memory30 of lockbox 12 contains data relating to the last 100 lockboxoperations. Oftentimes, however, not all 100 past operations are ofinterest. For example, the supervising real estate board or agency mayonly be interested in operations over a certain period of time. Tofacilitate this function, the lockbox access log can be marked with filemarks. The log can then be read in its entirety, or just from the lastfile mark to the end. By this technique, only the data of interest needbe reviewed.

The FILE MARK function is useful when a real estate agency or board isinterested in monitoring the access to a home during a specific period,as for example, during a weekend that the house is advertised in thenewspaper. In such case, the listing agent could enter a file mark inthe lockbox access log on a Friday evening. (Only the listing agent, orthe listing agent's broker or board, is permitted to executed a FILEMARK function on a lockbox). An agent could then return the followingMonday morning and recover only those entries in the access log madesince the log was marked by using the READ FILE MARK function.

If a lockbox is moved from one house to another, a file mark can be usedto indicate in the access log when the lockbox was moved. In one form ofthe invention, a file mark is entered in the access log automaticallywhenever the shackle is released. Data can then be selectively recoveredfrom the access log so that only operations logged at the new locationare recovered.

The entry that is actually recorded in the access log by a FILE MARKfunction is the same as any other logged function, but the log indicatesthat it is a FILE MARK function, rather than an OPEN, SHACKLE RELEASE,etc. The lockbox also records the other data usually stored in theaccess log, such as the identity of the user who executed the FILE MARKfunction, the date and time, etc.

Read

When the READ function is selected, lockbox CPU 28 causes all of theentries stored in the lockbox access log to be transmitted to therequesting key by relaying the access log data via the units' coupledcommunications coils. The key stores this received information in aportion of its RAM memory 56 dedicated to this purpose.

The portion of key RAM memory 56 dedicated to storing lockbox access logdata can be larger or smaller than the portion of memory in the lockboxdedicated to this task. Typically, the dedicated key memory is at leastas large as the dedicated lockbox memory (i.e. large enough to hold atleast 100 access entries). A key can thus read several lockbox accesslogs, provided the total number of access log entries read does notexceed the key's capacity.

If a user attempts to read a lockbox that has more access log entriesthan the key has memory, the key will display a corresponding errormessage and will not execute the READ function.

Successful execution of the READ function does not cause the access logdata in the lockbox to be erased. Instead, the data persists and iseventually overwritten by the lockbox itself, beginning when the onehundred and first log entry overwrites the first log entry. When thelockbox is later reinitialized and moved to a new listing, the accesslog data is dumped to a stand and the roll flag and pointer are reset totheir initial states.

As noted earlier, if any lockbox access log data is stored in the key,the READ annunciator will be made visible when the key is awakened bythe ON/CLEAR button so as to remind the user that one or more reads arestored in the key.

Read File Mark

READ FILE MARK is identical to the basic READ function except that onlythe lockbox access log entries since the last file mark are read.

Read NN

Lockbox CPU 28 maintains a lockbox access count in lockbox RAM memory 30that indicates the number of OPEN, SBA and SIGNATURE functions that havebeen executed by the lockbox since it was reinitialized for thatparticular listing. In the preferred embodiment, this count is stored asa single eight bit byte and thus can count up to 255 accesses. When theREAD NN function is selected and executed, lockbox CPU 28 transmits thislockbox access count to the key where it is displayed to the user in themessage portion of LCD display 50.

This READ NN function allows the user to monitor listing activity at aglance, without downloading data from the key to a stand at a remotelocation. This function also allows a user to monitor lockbox usage sothat the maximum memory capacity of the lockbox access log will not beexceeded and old data overwritten. For example, if the lockbox accesslog can store 100 entries and the user determines, by using the READ NNfunction, that there have been 90 accesses to the listing, the user maychoose to then dump the contents of the log into the key for laterrelaying to a computer through a stand. By such operation, the old datain lockbox access log is preserved in the computer and up to 100 newentries can then be logged in the lockbox.

Clear Memory

The CLEAR MEMORY function clears both the portion of key RAM memory 56dedicated to storing lockbox access log data and the portion of the keyRAM memory dedicated to storing lockbox characterization instructions.

The lockbox access log data normally stays in key RAM memory 56 untilthe key is coupled to a stand and the data dumped to a computer. If, forsome reason, the user does not want to preserve this data he can,instead of dumping it out to the computer, simply select the CLEARMEMORY function and erase it.

The lockbox characterization instructions stored in key RAM memory 56can variously stay in the key memory only until loaded into a lockbox orthey can stay indefinitely, depending on the nature of the instructions(discussed below in the discussion of the PROGRAM function). If, forsome reason, the user does not wish to preserve this data, the CLEARMEMORY function can be selected to erase it.

Signature

The access log maintained in the lockbox is useful for reasons otherthan determining, for security purposes, who opened the lockbox. It isalso desirable, for management information purposes, to be able todetermine the identity of persons who entered the house without openingthe lockbox.

Real estate agents often visit newly listed houses in large tour groups.The identity of the one agent in the group that opens the lockbox is ofcourse entered in the access log. The identity of the other agents inthe group could also be logged in the access log if they were also toopen the lockbox. However, the OPEN function draws a considerable amountof power from the battery. Consequently, it is desirable to be able tolog the identity of agents without requiring them to open the lockbox.The SIGNATURE function performs this task.

Agents who select the SIGNATURE function can engage their keys with thelockbox and have their identities logged in the access log. The lockboxtreats this function as an OPEN operation, but omits the final step ofenergizing the solenoids. Consequently, the power drain is negligible.By use of this function, the system is better able to maintain detailedinformation on visitors to a listed property.

The SIGNATURE mode has applications beyond real estate lockboxes. Forexample, a night watchman at an industrial complex could use theSIGNATURE function to log the date and time of his visits to the variouslocks around the complex without opening any such locks. A record couldthus be maintained of the surveillance activity at various sites aroundthe premises.

Shown By Arrangement

SHOWN BY ARRANGEMENT (SBA) is a function that allows a listing agent torestrict which other agents are allowed access to certain listedproperties.

Certain homeowners do not wish every agent in a real estate board to beable to gain access to their homes. They have placed their trust in onelisting agent and want only agents authorized by that agent to show thehouse. However, it is impractical for the listing agent to be present ateach such showing. The Shown By Arrangement feature of the presentinvention allows the listing agent to program the lockbox to requirethat a second code, an SBA code, be entered before access to the housekey is granted.

The SBA function is activated by specifying a desired four digit SBAcode in the lockbox characterization instructions. If no SBA code isspecified, a default value of 0000 is stored. When an agent tries toaccess a lockbox for which a non-zero SBA code has been specified, he orshe must do so by first selecting the SBA function. When the key is soarmed in the SBA mode, the agent is then prompted to select one of twofunctions from the prompt field: OPEN or CHANGE SBA.

If the OPEN function is selected, a "SBA" message is displayed inblinking form in the LCD display, prompting the agent to enter the SBAnumber. The agent then enters the four digit SBA number andcorresponding asterisks appear in the LCD display. After the code isentered, it is transmitted to the lockbox with the request to executethe OPEN function. If the SBA code entered matches the SBA code stored,and if other authorzation criteria discussed below are met, the functionis executed. If the SBA code entered does not match the SBA code stored,the function is immediately denied.

The second option after arming the key in the SBA mode is to change theSBA number. (When the key is armed in the SBA mode, a CHANGE prefix ismade visible in LCD display 50 next to the SBA prompt to permitselection of the CHANGE SBA function). This option can only be executedby the listing agent, the listing agent's broker or the listing agent'sboard. The lockbox checks that the identity of the key corresponds toone of these entities by comparing key identifying data sent from thekey with the lockbox identifying data stored in lockbox RAM 30.

When the CHANGE SBA function is selected, a "NEW" message appears in thekey LCD display 50 in blinking form, requesting the user to enter thenew SBA number. Again, like changing the four digit personal code, thisnew SBA number must be entered twice in order for the change to beeffected.

Program

The PROGRAM function transmits a set of limited characterizationinstructions from a key to a lockbox to effect a reprogramming of thelockbox in the field. Key CPU 52 will not make visible the PROGRAMprompt nor permit selection of the PROGRAM function unless the CPU hasearlier determined that the key contains a set of limited lockboxcharacterization instructions waiting to be downloaded into a lockbox.

The lockbox programs that can be loaded into the key from the computerin the exemplary embodiment can be of two types: Specific Update andBlanket Update. Specific Update is used when a set of lockboxcharacterization instructions is destined for one particular lockbox,identified by that lockbox's serial number. Once the program has beendownloaded to that lockbox, key CPU 52 automatically erases it from keyRAM memory 56. Specific Update is generally used to change a lockbox'sDaily Disable times and to set data switches enabling Privacy Read andPrivacy Shackle Release (discussed below in the section entitledProgrammable Lockbox Options).

Blanket Update, in contrast, is used when a set of lockboxcharacterization instructions is destined for a group of lockboxes.Downloading the instructions to a lockbox does not erase theinstructions from key RAM 56. Instead, the instructions persist in thekey until erased by the CLEAR MEMORY key.

Blanket Update is generally used to recharacterize lockbox instructionson an agency- or board-wise basis. Blanket Updates generally fall intotwo classes: those that update the lockout list and those that reprogramthe identity of the lockbox's listing agent.

Both Specific and Blanket Updates are transferred to the lockbox byusing the PROGRAM function. The difference between the two is an updatetype data string included with the key programming instructions whichindicates whether the update is a Specific Update or a Blanket Update,and, if it is a Blanket Update, whether it updates the lockout list orthe listing agent.

In the preferred embodiment, the programming of the lockbox by the keyin the field is limited so that only certain of the lockboxcharacterization instructions can be reprogrammed by the key. In theexemplary embodiment only the Lockout List data, the SBA number, theDaily Disable times and the listing agent identity can be reprogrammedin this manner, as is indicated in FIG. 13. The other data, such as thehouse, board and agency identification data and the lockbox accesscodes, cannot be changed by the key. To change this restricted data, theillustrated lockbox must be returned to a stand for reprogrammingdirectly by a computer.

The memory map of FIG. 13 illustrates that separate portions of key RAMmemory 56 are dedicated to storing lockbox characterization instructionsand copies of lockbox access logs. In other embodiments, a singleportion of key RAM memory 56 can be shared for these purposes.

PROGRAMMABLE KEY OPTIONS

The instructions needed to implement the following key options areprovided with the key control software stored in key ROM 64. Theseoptions are then individually enabled or disabled by setting appropriateenable/disable bits stored in key RAM 56 with the key characterizationinstructions.

Key Expiration Date

To enhance security of the system, some or all of keys 14 can beprogrammed to "expire" (become disabled) after a predetermined number ofdays. By this technique, keys that are lost or stolen lose their utilityin a relatively short time.

In RAM memory 56 of key 14 is data corresponding to a julian expirationdate on which the key is to expire. Before any functions requested bythe key are authorized, key CPU 52 first compares this expiration datewith data received from the calendar-clock portion of lockbox CPU 28indicating the current date. If key CPU 52 determines that itsexpiration date has passed, the requested function is denied. A signalis sent to lockbox 12 informing lockbox CPU 28 of the expired key forlogging in the lockbox's diagnostic maintenance log (discussed below inthe section entitled Diagnostic Features). A corresponding entry is madein the key's diagnostic maintenance log. The key then displays an errormessage indicating an expired key in the message portion of key LCDdisplay 50. After the message has been displayed for a predeterminedperiod of time, the key reverts to its sleeping state.

This expiration date feature significantly enhances system securitywithout imposing any significant burden on users of the system. Expiredkeys can be "rejuvenated" by an appropriate authority, usually thesupervising real estate board, by simply loading a new expiration dateinto key RAM 56 via a stand.

The present expiration feature also offers the supervising board and theindividual users considerable operational flexibility. For example, theboard can set a key to expire on any desired date. A key can thus beprogrammed to expire in a day, a week, a year or never, in increments ofone day. (To program the key to never expire, this function is simplynot enabled). This flexibility also enables the board to set differentexpiration dates for different keys. For example, it may wish the keysof new agents to require rejuvenation every two weeks, those ofestablished agents to require rejuvenation every two months and those ofbrokers to require rejuvenation only every two years. The expirationdates of the various keys can also readily be staggered so that all thekeys in the system will not need to be rejuvenated on the same day. Thesystem offers flexibility to users in that a key can be rejuvenatedbefore it expires. A key owner can thus rejuvenate a key at a time whenit is convenient, rather than at a time dictated by the lockbox owner.

Key Deactivation

Key 14 can selectively be deactivated to disable its further use bysetting an appropriate disable bit in key RAM 56. This is useful when,for example, a board or an agency wishes to store unused keys. Afterbeing deactivated, key 14 must be reinitialized with newcharacterization instructions from the board or other supervisingauthority before it can be used again.

PROGRAMMABLE LOCKBOX OPTIONS

The instructions needed to implement the following lockbox options areprovided with the lockbox control software stored in lockbox ROM 44.These options are then individually enabled or disabled by settingcorresponding enable/disable bits stored in lockbox RAM 30 with thelockbox characterization instructions.

Daily Lockbox Disable

Oftentimes, homes listed by real estate agents are not vacant. Thecurrent owner may still be residing in the house and may not welcomevisitors at certain hours. For example, a homeowner may work in theevenings and sleep during the days and consequently wish that his housenot be shown between the hours of 7:00 a.m. and 3:00 p.m. To accommodatesuch homeowners, CPU 28 of lockbox 12 can run a software routine, storedin lockbox ROM memory 44, that disables the lockbox from opening duringcertain hours of the day. The daily lockbox disable software routineoperates in conjunction with the calendar-clock portion of lockbox CPU28 and with programmable time data indicating the desired beginning andend times of the daily lockbox disable period. These beginning and endtimes are loaded into lockbox RAM memory 30 with the lockboxcharacterization instructions and can be loaded by an appropriatelyprogrammed key 14.

In the preferred embodiment of the present invention, lockbox CPU 28 isprogrammed to correct its internal calendar-clock data automatically toaccount for time changes brought on by daylight savings time so as tomaintain the desired daily disable times. Similarly, the calendar-clockportion of lockbox CPU 28 also corrects itself for leap years.

Lockbox Disable On Removal

After a real estate agent has released a lockbox shackle, the lockboxcould normally be reinstalled on another house. Before suchinstallation, however, the lockbox should be be reinitialized and loadedwith a variety of new characterization instructions identifying the newlisting, the listing agent, the listing agency, etc. In certainembodiments, this recharacterization could be accomplished by loading akey 14 with all of the new instructions and loading the lockbox from thekey using the PROGRAM function.

In most systems, however, this field reprogramming procedure isundesirable. It does not guarantee that the characterizationinstructions loaded by computer 18 into key 14 are actually transferredinto the lockbox. More importantly, it does not guarantee that theaccess log data stored in the lockbox is recovered and relayed back tothe computer for archival purposes.

In systems where data integrity is important, it is desirable that thelockbox be read and programmed directly by the computer without the useof an intermediate key. To insure thatthis is done, a Lockbox Disable OnRemoval feature is selectably provided.

When the Lockbox Disable On Removal feature is enabled by appropriatebits in the lockbox characterization instructions, the lockbox becomesdisabled when the shackle is released. In this disabled state, thelockbox cannot be operated nor can it be reprogrammed from the key. Itmust be returned to a stand at a board or agency office forreprogramming. By requiring the lockbox be returned for reprogramming,the access log can be reliably read for archival purposes, therebyinsuring the integrity of the board's lockbox database.

Lockout List

In certain instances, it may be desirable to lock out certain agents, oragents from certain agencies, and thereby deny them access to a listedproperty. In the preferred embodiment, RAM memory 30 of lockbox 12contains a list of key identification data that, although the keys soidentified may otherwise be authorized, are to be locked out. Theidentification data received from the accessing key is compared againstthis list by lockbox CPU 28. If the accessing key's identification datacorresponds with data found in this list, lockbox 12 will refuse toexecute any lockbox functions requested by the key.

In the preferred embodiment, there are three types of lockouts. Thefirst type of lockout identifies specific agents that are to be lockedout. The second type of lockout identifies specific agencies that are tobe locked out.

The third type of lockout identifies a specific agency that is to beallowed access to the house key. Agents from all other agencies are tobe locked out. By this third type of lockout, a house can be exclusivelylisted by a single agency so that only agents from that agency can showthe house.

Each of these lockout functions is implemented by certain enabling datastored in lockbox RAM memory 30 with the lockbox characterizationinstructions. If any of these functions is implemented, thecharacterization instructions further include data specifying theidentities of the agents or agencies who are to be locked out.

Lockout With Key Disable

As a further option on the lockout list function, lockbox CPU 28 can beprogrammed to disable certain locked-out keys that may attempt toexecute a function on the lockbox. In the exemplary embodiment, lockboxCPU 28 responds to each such preidentified key with a special signalthat instructs key CPU 52 to alter the key's four digit personal code inkey RAM memory 56 by replacing certain digits of this code withhexadecimal digits (A-F) which are not included on the key's keypad 48.With the personal code so altered, the user can no longer arm the keyfor use. The personal code can only be made usable again byreprogramming the key, which operation is usually only performed by thesupervising real estate board.

Updating Lockout Lists

It will be recognized that the lockout list data stored in each lockboxmay need to be updated frequently in order to be effective in lockingout undesired keys. In one form of the invention, key 14 has a portionof its RAM memory 56 dedicated to storing a lockout list. Stored withthis list is a date indicating the timeliness of the lockout list data.A date is also stored with the lockout list data stored in lockbox 12indicating its timeliness. Whenever key 14 and lockbox 12 communicate,these dates are compared by key CPU 52 or lockbox CPU 28. If it isdetermined that the lockout list data stored in key 14 is "fresher" thanthat stored in lockbox 12, the key's lockout list data, including thedate data, is transferred to lockbox RAM memory 30 where it overwritesthe "stale" lockout list data previously stored there. If it isdetermined that the lockout list data stored in lockbox list 12 is"fresher" than that stored in key 14, the lockbox's lockout list data,including the date data, is transferred to key RAM 56 where itoverwrites the "stale" lockout list data previously stored there. Bythis technique, one unit updates the other so that each has the newerlockout list data.

Privacy Read

Some listing agents, especially those who list expensive homes, may wishto prevent others from retrieving the lockbox access logs recorded intheir lockboxes. These logs may reveal the identities of the agentswithin the real estate board whose clientele can afford expensive homes.This is useful information that the listing agent may not wish to sharewith other agents.

In order to maintain the privacy of this information, the lockboxes ofthe present invention can be programmed, by an appropriate bit in thelockbox characterization instructions, to allow only the listing agent,or that agent's broker or board, to retrieve the lockbox access log. Ifthis enable bit is set, lockbox CPU 28 compares the identification datareceived from the key with its own lockbox identification data beforeallowing an otherwise authorized READ operation to be performed. Accessto the lockbox access log can thereby be limited to this authorizedclass of keys.

Privacy Shackle Release

It is generally desirable to restrict execution of the SHACKLE RELEASEfunction to the listing agent, or to that agent's broker or board. Torestrict execution of the SHACKLE RELEASE function in this manner, aPrivacy Shackle Release function is provided. If this function isenabled, lockbox CPU 28 compares the identification data received fromthe key with its own lockbox identification data before allowing aSHACKLE RELEASE function to be performed.

Lockbox Deactivation

Lockbox 12 can selectively be deactivated to disable its further use bysetting an appropriate disable bit in lockbox RAM 30. After beingdeactivated, lockbox 12 must be reinitialized with new characterizationinstructions from the board or other supervising authority before it canbe used again.

DIAGNOSTIC FEATURES Power-On Diagnostics

As soon as key 14 is awakened by pressing the ON/CLEAR button, a set ofdiagnostic routines is run to confirm proper operation of the key.

As a first check, key CPU 52 determines whether the "master softwareswitch" is off. The master software switch is a flag in key RAM memory56 that indicates whether the key's characterization instructions arecorrupted. This switch is turned off every time a process of criticalloading characterization instructions from a computer into the key isbegun. The switch is not turned back on again until the transfer ofinstructions is completed without error. If, for example, the key isremoved from stand 16 before the transfer is completed, thecharacterization instructions n key RAM memory 56 will be incomplete.Key CPU 52 recognizes this data corruption by noting that the mastersoftware switch is still off and accordingly prevents the key fromattempting any operations until the characterization instructions areloaded correctly. (Provision is made for reloading new characterizationinstructions from a properly authorized computer through a stand evenwhen the master software switch is off).

As a second check, key CPU 52 determines whether there is any button onkeypad 48 that is stuck in the down position.

As a third check, key CPU 52 determines whether the key is in personalcode timeout mode. Personal code timeout mode is the ten minute periodfollowing four unsuccessful entries of the personal code.

As a fourth check, key CPU 52 performs a non-destructive test on key RAMmemory 56 to determine if it is malfunctioning.

If any of these four error conditions is detected, a corresponding errormessage is presented in the message of LCD display 50 for a five secondperiod and the key then returns to sleep.

If none of the error conditions is detected, the key then examines thestatus of the key battery. If it needs to be replaced, key CPU 52 makesvisible the KEY BATTERY annunciator for the remainder of the key'soperations. If the key battery count (discussed below) is equal to zero,CPU 52 causes LCD display 50 to display the message "DEAD"0 for apredetermined period of time and then go to sleep.

If the diagnostic tests are run successfully, the key allows the user toproceed and enter the four digit personal code, etc.

Error Messages

The message display portion of the LCD display 50 can indicate up to 100errors by displaying messages ER00 through ER99. The error codes arevery finely detailed so that a user can determine quite accurately thenature of a problem by reference to the two digit code. Selected errorconditions displayed in this manner include pushing a wrong button, deadbattery, wrong personal code, key in personal code timeout mode,keyboard button stuck, master software switch off, etc.

Diagnostic Maintenance Log

Occasionally, a vendor or manufacturer may receive reports that alockbox or key is malfunctioning. To aid in investigation of suchreports, the lockboxes and keys of the present invention each have aportion of their RAM memories dedicated to storing detailed diagnosticinformation. In the preferred embodiment, detailed information on thelast ten events noted by the lockbox or key microprocessor is stored inthis "diagnostic maintenance log." Each diagnostic maintenance log entryidentifies the events noted and the key or lockbox unit's response.

The diagnostic maintenance log entry of an exemplary OPEN operation inthe key might be as follows. The key is energized by the ON/CLEARbutton. If one of the Power-On diagnostics is failed, a correspondingentry is made in the diagnostic maintenance log. Assuming the Power-OnDiagnostics are run successfully, the user is allowed to enter the fourdigit personal code. If the wrong code is entered or if no code isentered within the ten second time period, a corresponding entry is madein the maintenance log. Assuming the personal code is correctly entered,the user is next prompted to select a function. Again, if an error ismade by the user in selecting a function or if the function selected isdenied by the system, a corresponding entry is made in the maintenancelog. This process of logging any error condition continues until the keyreturns to sleep.

Although not recited in the foregoing example, it should be noted thatan interruption in the communications between a lockbox and key is anevent that is always recorded as an entry in the diagnostic maintenancelog.

Depending upon the requirements of a particular application, each CPUcould be programmed to record data on all events, or only on thoseevents that prevent the requested operation from being executed.

It will be noted that the lockbox access and diagnostic maintenance logsof the present invention serve two entirely different purposes. Thelockbox access log serves as a record, for legal or managementinformation purposes, of a narrow range of lockbox operations. Thelockbox access log only logs OPEN, SBA, SHACKLE RELEASE, SIGNATURE andFILE MARK functions. It logs both successful and unsuccessful OPEN, SBA,SHACKLE RELEASE and SIGNATURE functions, but only logs FILE MARKfunctions if they are successful. If an unsuccessful function is logged,no diagnostic data indicating the reason for the failure is recorded.With each of these access log entries, however, the lockbox logs avariety of ancillary data, such as the date and time of the operationand the identity of the key requesting the operation.

The diagnostic maintenance log, in contrast, serves only as a diagnostictool. It serves in this capacity for all lockbox or key operations, notjust those four which are of concern to the lockbox access log. For eachoperation, it stores detailed diagnostic information. However, no time,date or identification data is logged.

Upon reports of a malfunctioning lockbox or key, the correspondingdiagnostic maintenance lgg can be retrieved, either by sending themalfunctioning unit to the board for coupling to the board computer orby coupling the unit to the board computer through a stand 16. This datacan then be evaluated to determine the cause of the malfunction.

Remote Testing

In addition to retrieving diagnostic maintenance log data from keysafesand locks for coupling to a computer, stand 16 further serves adiagnostic function by enabling a computer to conduct detailed testingon a malfunctioning lockbox or key unit. A lockbox or key that ismalfunctioning can be put on a stand and the central board officecomputer called. The central computer can then run a collection ofdiagnostic routines and indicate to the user the cause of the problem.If the board's central computer is not able to diagnose the problem, thevendor or supplier of the equipment can run exhaustive diagnosticroutines directly from its office to the unit on the stand at the remotelocation.

AUTHORIZATION OF LOCKBOX OPERATIONS

The determination of whether a key is authorized to operate a lockbox ismade by comparing certain strings of data exchanged between the lockboxand key. An operation is only authorized if these data stringscorrespond to a specified degree. This process is explained in moredetail below.

In the preferred embodiment, the exchange of signals between the key andlockbox comprises a multipart handshake. First, key 14 sends a first,interrogation signal to lockbox 12 to cause the lockbox to wake up fromits sleeping state. Lockbox 12 responds by sending a second signal backto the key. This second signal includes lockbox battery condition dataand date data (provided by the calendar-clock portion of CPU 28).

Upon receiving this data, key CPU 52 compares the received date datawith the key expiration date stored in key RAM memory 56, as discussedearlier. If it is determined that the key is not expired, key CPU 52then sends lockbox CPU 28 data identifying the key by agent, agency andboard so that the lockbox can determine whether the requested functioncan be executed on the basis of an ownership match between the lockboxand key. Lockbox 12 has corresponding identification data, identifyingits listing agent, agency and board, stored in its RAM memory 30. Inorder for lockbox 12 to authorize execution of the requested function onthe basis of an ownership match, lockbox CPU 28 compares the keyidentification data received from the key with its own lockboxidentification data to determine whether they correspond to a requireddegree. The degree of correspondence required between these groups ofdata before an operation is authorized is specified by "permissioncodes" stored in the key and sent to the lockbox with the keyidentification data.

Permission Codes

At one extreme, the permission codes may require only that the lockboxand key identification data indicate that the lockbox and key areassigned to the same real estate board in order for the lockbox toauthorize the requested operation. At the other extreme, the permissioncodes may specify that even if the lockbox and key are assigned to thesame board, agency and agent, the lockbox will still not authorize therequested function. In between these extremes, the permission codes mayspecify that the corresponding elements of board and agencyidentification data match, or; that the corresponding elements of board,agency and agent identification data match, before the lockbox willauthorize a requested operation.

Three different permission codes are stored in key RAM memory 56corresponding to three groups of lockbox operations. The firstpermission code specifies the degree of match required between thelockbox and the key identification data before an OPEN, SBA, change SBAor FILE MARK function will be authorized. The second permission codespecifies the degree of match required between the lockbox and keyidentification data before the SHACKLE RELEASE function will beauthorized. The third permission code specifies the degree of matchrequired between the lockbox and key identification data before any ofthe READ functions will be authorized. (The remaining functions do notdepend on permission codes for authorization. CHANGE PERSONAL CODE,CLEAR MEMORY and CONTROLLER are functions executed by the key alone, notin cooperation with a lockbox SIGNATURE does not require any ownershipmatch for execution. PROGRAM generally cannot be executed unless thereis a match between the owner of the computer that loaded the programminginstructions into the key and the owner of the lockbox.)

Each permission code can assume one of four values as follows:

4--Disabled

3--Requires board, agency and agent match

2--Requires board and agency match

1--Requires onIy board match

If lockbox CPU 28 finds the requisite match between the lockbox and keyidentification data, the lockbox authorizes and executes the requestedfunction. If the lockbox CPU does not find the requisite match, thesystem then examines whether the function might be authorized based onan "access code" match.

Access Codes

If the requested function is OPEN or SBA, key 4 may authorize thefunction based on an access code match.

Both lockbox 14 and key 12 have at least one access code stored in theirrespective RAM memories. (In one form of the invention, up to fifteenaccess codes can be stored in each unit). The access codes stored in thelockbox are each three bytes long. A two byte field identifies the realestate board. A one byte field is arbitrary. The access codes stored inthe key also contain a two byte field identifying the board and a onebyte arbitrary field. The key access codes, however, each additionallycontain an expiration date field. If the requested function is an OPENor SBA function and if the function was not authorized by apermission-code specified ownership match, the lockbox transmits itsaccess codes to the key for evaluation by key CPU 52.

After receiving the lockbox access codes, key CPU 52 compares each ofthe lockbox access codes with each of the key access codes stored in keyRAM 56. If key CPU 52 finds a match, it then compares the expirationdate associated with the matching key access code with the date datareceived earlier from the lockbox to determine whether the key accesscode involved in the match is nonexpired. If the code is nonexpired, thekey sends the lockbox a signal instructing the lockbox to execute therequested OPEN or SBA function.

If none of the key access codes matches any of the lockbox access codes,or if only expired key access codes match lockbox access codes, the keysends the lockbox a signal instructing the lockbox not to execute therequested OPEN or SBA function.

Summarizing the procedure by which a function is authorized, if therequested function requires a permission code-specified ownership matchand such match is found, the lockbox authorizes the requested function.If the requested function is an OPEN or an SBA and if the permissioncode-specified match is not found, the key can nonetheless authorize thefunction if any of the lockbox access codes match any of the nonexpiredkey access codes.

It should be noted that the particular function authorization processdescribed above was adopted because it minimizes the amount of datatransmitted between the lockbox and key units and because it made themost efficient use of the processing and memory capabilities of therespective units. However, the elements of data exchanged and thedistribution of the decision making tasks between the two CPUs couldreadily be altered to meet the requirements of other applications.

Segmentation/Regionalization

The access code system of the present invention provides severalcapabilities that have been difficult or impossible to implement inprior art lockbox systems. One such capability is board segmentation andregionalization.

In a typical system, the arbitrary byte included in the lockbox and keyaccess codes is used to segment or regionalize the properties listed bya real estate board into a variety of classes. For example, a board maydeal in both residential and commercial properties, but not wantresidential agents to gain access to commercial listings and vice versa.In this case, the arbitrary byte in the lockbox access codes of thelockboxes installed on commercial properties could be set to "1" and thearbitrary byte in the lockbox access codes of lockboxes installed onresidential properties could be set to "2." The keys of commercialagents would then be programmed to have an access code terminating in"1," while the keys of residential agents would be programmed to have anaccess code terminating in "2." With the access codes so set,residential agents would be prevented from gaining access to commercialproperties and vice versa.

Inter-Board Cooperation

In addition to enabling real estate boards to segment and regionalizetheir listings, the access code system of the present invention alsoenables real estate boards to cooperate in the sales of properties. Forexample, Board A may wish to allow all agents from neighboring Board Bto have access to a lockbox on a particular house within Board Aterritory in order to expedite its sale. To do this, Board A would addto this lockbox's access code list an additional access code comprisedof two bytes identifying Board B, together with the one byte arbitraryfield that is in general use by Board B. By so doing, Board A enablesall agents from Board B to open the lockbox with their existing Board Bkeys.

Similarly, an agent (c) from Board C may wish to show a client houseslisted for sale in neighboring Board D. To do this, agent (c) would callBoard D and request that it load an access code into agent (c)'s keythat matches the access code (or codes) resident in the Board Dlockboxes to which agent (c) seeks access. (A board can only load a keywith key access codes having that board's identifying two byte field).The loading of these access codes could be done by Board D's computerover telephone lines into agent (c)'s key via a stand, regardless of thedistance between Boards C and D. Board D would doubtless also append anexpiration date to the codes loaded into agent (c)'s key so that agent(c) could only access the properties in Board D for a limited period,such as a day or two.

Additional Information on Permission Codes

Like the access code system described above, the permission code systemalso gives the present invention capabilities that were difficult orimpossible to implement in prior art lockbox systems. For example, thepermission code system enables keys to be delegated differentcapabilities corresponding to the needs and privileges of differentusers.

As noted, each key is programmed with permission levels for threedifferent classes of functions: OPEN/SBA, SHACKLE RELEASE and READ. Inoperation, the permission levels indicate the degree of ownership matchrequired between a key and lockbox before the two units can cooperate toexecute a function.

The different permission codes in a key are assigned independently ofone another, so that a key can have one permission code for certainfunctions and different permission codes for other functions. Thisfeature allows boards and agencies to vary the capabilities of theirkeys simply by reprogramming the permission codes stored with the keycharacterization instructions. Such specialized keys have severalapplications. For example, an agency may wish to hire a courier to visitvarious houses listed by the agency to retrieve the lockbox access logs.However, the agency may not want the courier to have access to the keycompartments of any of these lockboxes. To limit the courier'scapabilities in this manner, the agency puts the key in the stand andsets the permission codes for OPEN/SBA and SHACKLE RELEASE to 4. Apermission code of 4 prevents the function from being executed,regardless of the degree of ownership match between the lockbox and key.The READ permission level is set to 2, which allows the key to read thelockboxes on all the houses listed by the agency. The courier can thengo and retrieve data from all these lockboxes and yet be unable to gainaccess to any of the house keys.

As far as the permission levels are concerned, there is no distinctionmade between listing agents and nonlisting agents. A permission code of3 is generally assigned to each. However, listing agents can performsignificantly more functions at a lockbox than a regular agent. Forexample, listing agents can change the Shown By Arrangement code and canexecute Privacy Reads. These privileges, however, are not granted byreference to permission codes in key RAM 56. Instead, such restrictedfunctions are authorized only when CPU 28 or CPU 52 has confirmed thatthe key requesting execution of the function is owned by the listingagent associated with the lockbox (or that agent's broker or board). Ifno such match is found, the key owner is refused authorization toexecute the listing agent functions.

Industrial Applications of Permission Codes

The permission code system of the present invention has applications inthe industrial security market as well as in the real estate lockboxfield. An industrial site can be tiered in a manner analogous to theagent, agency and board levels used in lockboxes. For example, anindustrial site could be tiered into employee, building master and sitemaster levels. The employees of a company could be assigned permissioncodes of 3, allowing them to unlock only the doors for which they arethe responsible employees. Building security guards could be assignedpermission codes of 2, allowing them to unlock all doors in theparticular buildings for which they are responsible. Master securityguards could be assigned permission codes of 1, allowing them to unlockall doors on the site.

Permission Codes and Computers

The permission code system of the present invention is also used withcomputers 18. Each computer is assigned a permission code that specifieswhich lockboxes and keys it can work with. If the computer belongs to anagency, it will be assigned a permission code of 2. A computer with apermission code of 2 can only be used to interface, through a stand,with keys and lockboxes assigned to that same agency. If the computer isowned by the board, it will be assigned a permission code of 1 and canbe used to interface with all keys and lockboxes in the real estateboard.

The permission code assigned to a computer also limits the authority itcan delegate to a key. A computer can delegate different levels ofauthority to a key by the permission codes that it loads into the keywith the characterization instructions. A computer can reprogram a key'spermission codes to the computer's own permission code or to any morerestricted level. For example, a computer owned by an agency canreprogram a key to have permission codes of 2, 3 or 4. Such a computercannot be used to program a key to have permission code of 1, for thiswould be delegating authority to the key higher than the computer's ownauthority. A board level computer, due to its permission code of 1, canbe used to program or read any lockbox or key owned by the board.

COMMUNICATIONS

Digital Reconstruction Modulation

As noted, communication between the lockboxes, keys and stands of thepresent invention is effected by electromagnetically coupled coils. Inthe prior art, exchange of data over coupled coils was effected bymodulating the data signal onto an audio frequency or radio frequencycarrier. Such electromagnetic coupling has previously been poorly suitedfor use in such battery powered applications because the modulatedcarrier draws a relatively large amount of power from the battery.

In order to minimize battery drain, the present invention employs a newmodulation scheme, termed here "digital reconstruction modulation." Inthis system (FIG. 19), the raw data signal which is switching, forexample, between zero volts and two volts, is applied directly across afirst, transmitting coil 300. Across a second, receiving coil 302 isinduced an alternating series of positive and negative transient voltagespikes corresponding to the transitions in the data signal. Thesetransient voltage spikes are applied to a Schmidt trigger circuit 304.The Schmidt trigger circuit toggles states only when the voltage appliedto its input is above a first threshold voltage or below a secondthreshold voltage. These threshold voltages are selected so that thepositive transients exceed the first threshold voltage and so that thenegative transients drop below the second threshold voltage. Thepositive transients thus cause the Schmidt trigger to toggle on and thenegative transients thus cause the Schmidt trigger to toggle off. Theoutput signal provided by the Schmidt trigger is thus identical to thedata signal applied to the transmitting communications coil,reconstructed by virtue of the Schmidt trigger's hysterisis properties.

Depending on the relative orientation of the two communicating coils, alow to high data signal transition applied across the first coil maycause a positive or a negative voltage transient across the second coil.Thus, the data signal recovered by the Schmidt trigger may be theinverse of the data signal applied to the first coil. This detail can betaken care of by starting the exchange of data between system units witha known data string. If the CPU in the receiving unit detects that theknown data string is inverted, it can cause the output from the Schmidttrigger to be inverted again, bringing the signal back to its propercondition, for the remainder of the communications. Alternatively, theproblem of data inversion can be eliminated entirely by insuring thatthe communicating components are always coupled in the desiredorientation.

One advantage of this digital reconstruction modulation is that theeffective rangeover which the coupled coils can communicate is not, asin the prior art, determined by the current drawn by the transmittingcoil. Instead, the strength of the received signal is dependent solelyon the rise time and fall time of the input data signal and on thecoefficient of coupling between the transmitting and receiving coils.The voltage induced in the receiving coil is proportional to the timerate of change of this input signal. Thus, limiting the current in thetransmitting coil, for example by a current limiting circuit set toclamp the coil current at one milliampere, does not significantly reducethe communications range. Range is only limited by the switching speedof the component logic.

A second advantage is that the data transmission rate is not limited bythe frequency of a carrier signal carrying the data. Again, the onlylimits imposed are by the switching speeds that can be obtained in thecoil circuit.

Adaptive Communications

The maximum speed at which lockbox, key and stand components cancommunicate with one another varies as a function of temperature,component tolerances and component aging. In a worst case situation, onesystem component might be able to communicate at only one-third thespeed of another component. Instead of using a communication speed thatis certain to be within the capability of all system components (i.e.the lowest common denominator speed), the present invention employs anadaptive communications scheme that optimizes the communications ratefor a particular pair of communicating components.

As noted earlier, communications between units are generally begun bythe key sending an interrogation signal to wake up the lockbox. Beforethe lockbox responds with its response signal identifying the lockbox,reporting on battery state, etc., as discussed earlier, the two unitsfirst agree on a data transmission speed.

To set the data transmission speed, each unit sends the other itsshortest data element. In the present invention, a data 0 is representedby a signal duration of a first period and a data 1 is represented by asignal three times longer. To set the data transmission speed, the keythus sends to the lockbox a data 0 at the key's top speed. Lockbox CPU28 measures the duration of this signal and stores this value in its RAMmemory 30. Lockbox CPU 28 then sends the key a data 0 signal at thelockbox's top speed. Key CPU 52 in turn counts the duration of thissignal and stores this value in its RAM memory 56. CPUs in both unitsthen compare the duration of the signal received with the duration ofthe signal they sent in order to determine which unit is operating moreslowly. The CPU in the faster unit then reduces its data communicationsspeed in order for the length of its data 0 to match that of the slowerunit. (The speed at which each unit transmits is set by a data word inthe unit's RAM memory, which word can be altered by the CPU to effectthe speed change). By this technique, the two units adapt to operate atthe highest speed that both units can manage.

After two communicating units agree on a data transmission speed, theythen exchange bits of data, such as the data 0 signal, alternately,approximately 20 times, in order to confirm that a reliablecommunications link has been established. If these twenty exchanges ofdata 0 signals are completed without interruption, the communicationslink is considered to be reliable and the exchange of functionauthorizing data between units is begun.

BATTERY SYSTEMS

A comprehensive battery monitoring system is employed in the presentinvention to prevent the lockbox and key batteries from failing andrendering the associated units inoperative. The battery monitoringsystems rely on three independent criteria to determine when eachbattery is nearing the end of its useful life: elapsed time, usage andcurrent drain from the backup battery. When the lockbox or key CPUdetects either of the first two of these three low battery criteria, itloads a battery count number, such as 16, in its memory. (When the CPUdetects the third low battery criteria, it immediately loads a batterycount of zero in its memory). This battery count number is thendecremented each time a lockbox or key operation is performed. Thebattery count represents the number of additional operations that thelockbox or key will perform before it curtails operation.

If the lockbox battery is low, the key informs the user of thiscondition just before the key returns to sleep. Each time the lockboxand the key communicate, the lockbox indicates to the key the status ofthe lockbox battery. If any of the three low battery criteria have beenmet, the lockbox relays the lockbox battery count to the key, which inturn displays this number in the message portion of its LCD display 50and makes visible the KEYSAFE BATTERY annunciator in the top portion ofthe LCD display. The key then beeps to call the user's attention to thedisplay. The number displayed in LCD 50 is the number of additionallockbox operations that the lockbox will allow before it curtailsactivities to prevent battery failure. The key maintains this LCDdisplay for approximately two minutes before going to sleep.

In alternative embodiments, the lockbox battery count is not displayedon the key's LCD display. Instead, the KEYSAFE BATTERY annunciator andthe beeper alone are used to warn the user that the lockbox will sooncurtail its operations. By not informing the user of the precise numberof lockbox operations left, it is hoped that the user will replace thelockbox battery without delay.

If the key battery is low, the user is reminded by the KEY BATTERYannunciator. Each time the key is powered on by the ON-CLEAR button, keyCPU 52 examines the portion of key RAM memory 56 in which the keybattery count is stored. If key CPU 52 finds a count, the count isdecremented and the KEY BATTERY annunciator is made visible and remainsvisible for the duration of the key's operation.

For expository convenience, the following discussion of the three lowbattery criteria focuses on the lockbox battery monitoring system. Thekey battery monitoring system is analogous.

First Low Battery Criterion

The first low battery criterion is elapsed time. When a new battery isinstalled in the lockbox, a date counter is started that increments eachday or other set period. The first low battery criterion is met whenthis count reaches a predetermined value, such as three years. That is,the system presumes that the lockbox battery is nearing the end of itsuseful life when it is three years old.

The predetermined time period at which the battery is assumed to benearing the end of its useful life can be chosen to correspond to theparticular circumstances of the lockbox. For example, if the lockbox isused in a cold environment, such as in Alaska, its "shelf life" will belonger than if it is used in southern Florida. Similarly, thepredetermined period can be chosen to correspond to the type of batteryinstalled. If alkaline batteries are used, the predetermined periodwould be set to a longer period than if conventional carbon batteriesare used.

Replacement of the primary battery in the unit is detected by lockboxCPU 28 which monitors the voltage of the primary battery. When thisvoltage is interrupted and then restored, lockbox CPU 28 assumes thatthe battery has been replaced and resets the date counter accordingly.In an alternative embodiment, lockbox CPU 28 is informed of the removaland subsequent replacement of a primary battery by a microswitchpositioned in the lockbox battery compartment.

Second Low Battery Criterion

The second low battery criterion is battery usage. When a new battery isinstalled in the lockbox, a battery capacity number is stored by lockboxCPU 28 in RAM memory 30. This number represents, very conservatively,the total estimated capacity of the battery. Each time an operation isperformed, this number is decremented by a number representative of theenergy actually consumed. The second low battery criterion is met whenthis battery capacity number reaches zero.

The battery capacity number loaded into RAM memory 30 when the batteryis replaced could again be chosen to correspond to the particularcircumstances of that lockbox. For example, if the lockbox is used in acold environment, its battery will be less able to deliver successivelarge current loads than if it is used in a warm climate.

The amount by which battery capacity number is decremented is a functionof the particular operations performed and their duration. In anexemplary lockbox system, the operations can be grouped into threeclasses: operation of a pair of locking solenoids, operation of thecommunications coil and operation of the remainder of the circuitry.Each of these operations is considered by lockbox CPU 28 to consumeenergy at a fixed rate. A pair of locking solenoids may be considered toconsume energy at a rate of 3 watts, the communications coil at a rateof 5 milliwatts and the remainder of the circuitry at a rate of 1milliwatt. Each time any of these operations is performed, CPU 28operates a corresponding timer to measure its duration. The measuredduration of each operation is multiplied by its assumed energyconsumption rate to estimate the amount of energy actually withdrawnfrom the battery. These measures of energy usage are then subtractedfrom the battery capacity number stored in RAM memory 30 to provide anindication of the battery energy remaining. As noted, the second lowbattery criterion is met when this battery capacity number isdecremented to zero.

In an alternative embodiment, the second low battery criterion is simplythe number of operations performed by the lockbox. When a new battery isinstalled, a second counter, this one an operations counter, is started.This operations counter counts the number of high power operations(i.e., lockbox operations that energize solenoids, such as OPEN andSHACKLE RELEASE) performed by the lockbox. The second low batterycriterion in this alternative embodiment is met when this operationscounter reaches 1000. That is, the system presumes that the lockboxbattery is nearing the end of its useful life after 1000 high poweroperations have been performed.

Third Low Battery Criterion

Both of the above two low battery criteria assume that the batteryinstalled is new and functioning properly. However, in the event that aused or faulty battery is installed, a third low battery criterion isconsidered. The third low battery criterion is current drain from thebackup battery.

Normally, no current is drawn from lockbox backup battery 34. The backupbattery only supplies current when primary battery 32 is not able tomeet all the lockbox's power requirements. When lockbox CPU 28 detectsthat current is being drawn from backup battery 34, this third lowbattery criterion is met and the system presumes that the primarybattery is at the end of its useful life. In this instance, unlike thepreceding two, the battery count number is immediately set to zero sothat any energy remaining in the primary battery can be preserved for aSHACKLE RELEASE operation.

Additional Details on Battery Systems

As noted, once either of the first two low battery criteria has beendetected, a counter is set to an arbitrary number, such as 16, and isdecremented each time an additional lockbox operation takes place. Thiscount begins at a relatively low number, such as 16, rather than at ahigher number because if the number is too high, users will likelyignore it for too long.

In alternative systems, the battery count could increase. However, ithas been found that users rarely remember what the top number is, butalways know what zero means.

If the lockbox battery count reaches zero (or is set to zero bydetection of current drain from the backup battery), OPEN and SBAfunctions are denied to everyone except keys owned by the board itself,as determined with reference to a permission code of 1 in the key. Atthis point, the lockbox is of little utility. Other operations aresimilarly prevented, such as FILE MARK, SBA and change SBA. However, theremainder of the functions, including SHACKLE RELEASE, can still beperformed, thereby allowing the listing agent (or the listing agent'sbroker or board) to remove the lockbox and replace the batteries. In thepreferred embodiment, after the lockbox battery count reaches five, thelockbox control software will only allow the listing agent (or thelisting agent's broker or board) to execute the OPEN or SBA function.

The low battery criteria and associated numerical constants discussedabove are selected so that even when the battery count reaches zero, thebattery still has approximately half of its capacity left. This reservecapacity insures that the high power SHACKLE RELEASE function can stillbe performed. The lockbox battery capacity is prevented from drainingmuch below this point by preventing high power OPEN functions.

Backup Battery Monitoring

In one form of the invention, the backup batteries in the lockbox and inthe key are also monitored so as to determine when they are nearing theends of their useful lives. In an exemplary embodiment, each lockbox andkey includes a software timer that counts the time elapsed during whichthe backup battery is the sole power source for the unit, such as whenthe primary battery has been removed. When this timer reaches apredetermined count, an appropriate warning message is displayed in themessage portion of key LCD display 50 indicating that the appropriatebackup battery should be replaced

In alternative embodiments, more complex backup battery monitoringschemes, such as those used with the primary batteries, can be employed

RADIO UPDATING

In one form of the invention, data in lockboxes and keys throughout thereal estate board can be updated by radio. By this technique, bothboard-wise changes of data, such as changes of lockout lists and accesscodes, and changes targeted to specific units, such as disabling aparticular key, can be implemented simply and quickly.

For expository convenience, the following discussion focuses on radioupdating of lockboxes. However, an analogous system can similarly beemployed for radio updating of keys.

In systems employing radio updating, the data to be loaded into thememories of the lockboxes is modulated onto a subcarrier transitted witha conventional FM broadcast. The source of the data can be aconventional modem driven from board computer 18. A receiver in eachlockbox decodes this data from the modulated subcarrier and reloads itsmemory according to these instructions.

In more detail, the signals broadcast by FM stereo radio stations have abandwidth of 200 kilohertz, 100 kilohertz on each side of the carrierfrequency. The FM stereo audio and stereo pilot occupy the spectrum fromthe carrier frequency out 53 kilohertz each side. The portion of thespectrum from 53 to 100 kilohertz on either side of the carrier isvacant and is presently being used for a variety of other subcarrierservices, such as transmission of commercial free music, educationalmaterials and stock market reports. In the present invention, the datafrom board computer 18 to be sent to the individual lockboxes ismodulated on a subcarrier positioned at 76 kilohertz in the FM basebandsignal, approximately midway in this vacant range of frequencies.Referring to FIG. 20, the digital data from the board computer 18 isprovided to a subcarrier generator 200 connected to an exciter 202 ofthe FM transmitter 204. The subcarrier generator generates the 76kilohertz subcarrier signal which is modulated with the data.

This modulated FM signal is received by a receiver 206 in each lockbox.The received FM signal is fed from an antenna 208 (discussed below) to amixer 210 through an RF preselector/attenuator circuit 212. RFpreselector/attenuator circuit 212 provides some attentuation of out ofband signals while amplifying the desired signals, thereby minimizingthe receiver's noise figure. Mixer 210 mixs the desired FM broadcastsignal received by antenna 208 with a local oscillator signal from alocal oscillator 214. The frequency of local oscillator 214 is selectedto produce an up-converted first intermediate frequency (IF) of 384megahertz.

The output from first mixer 210, including the 384 megahertz IF, is fedto an IF section 216. IF section 216 includes a first filter 218 whichpasses the desired 384 megahertz signal and rejects the unwanted mixerproducts. Filter 218 desirably comprises a surface acoustic wave filter.The output from filter 218 is fed to a second mixer 220. Second mixer220 mixes the signal from filter 218 with the signal from a second localoscillator 222. Second local oscillator 22 provides a 394.7 megahertzsignal, thereby yielding a down-converted second receiver intermediatefrequency of 10.7 megahertz. The output from second mixer 220 is fed toa second filter 224 which attenuates the undesired mixer products andpasses the 10.7 megahertz signal to IF amplifier circuit 226. Secondfilter 224 can be a standard 10.7 megahertz ceramic filter of the typecommonly used in FM receivers.

IF amplifier 226 amplifies the 10.7 megahertz signal from filter 224 toa level suitable for detection by a phased lock loop detector circuit228. Detector 228 demodulates the IF signal and provides a widebandcomposite audio signal to an SCA band pass filter 230. SCA band passfilter 230 passes the desired subcarrier channel to an SCA decoder 232,while attenuating the lower frequency audio components. Decoder 232demodulates the filtered SCA channel and provides the demodulated audioto a modem circuit 234 that converts the modem signals originallyencoded on the subcarrier back to digital data form. The output frommodem 234 is treated just as any other data input to the lockbox, as forexample through the communications coil, and is used to effect thereprogramming of the lockbox RAM memory 30.

In certain embodiments, antenna 208 can include lockbox shackle 22 asits principal component. In such cases, shackle 22 is insulated withinthe case to prevent it from contacting the lockbox's electrical groundand is similarly insulated outside the case, as by an insulating vinylrain guard enclosing the shackle, to prevent it from contacting thestructure to which is is fastened. Although the shackle is a smallantenna, it can be resonated by preselector/attenuator circuit 212 so asto operate as a low impedance resonant antenna at the frequency ofinterest.

In some lockbox mounting positions, such as on a grounded water faucet,the electrical coupling between the shackle antenna and ground may besufficient, despite any intervening insulation, to reduce the strengthof the received signal to a point at which it cannot be decodedreliably. Accordingly, it is often desirable to use an antenna that doesnot include the shackle as a principal element. Such an antenna may takethe form of a planar coil encased in plastic and mounted on an exteriorsurface of the lockbox. Such an antenna can also be used on or in aradio-updated key.

In still another form of the invention, antenna 208 can comprise aninsulated conductor wound about shackle 22 so as to form a helicallyloaded loop.

Because the radio updating process involves alterations to the lockboxmemory, it is desirable that the updating not be interrupted by requestsfrom keys to operate the lockbox. Consequently, it is desirable that alllockbox updating be done between the hours of midnight and 6:00 a.m., aperiod during which the lockboxes would not normally be in use. Eachlockbox can be programmed to energize its receiver circuitry for this orany other predetermined period every night to listen for updates fromthe board office. This window period can be a few minutes long or a fewhours long. Data sent from the central board office can be directed toall the lockboxes, or can include an introductory address data stringidentifying a particular lockbox to which the data is targeted. Ineither event, the transmissions from the board office can additionallyinclude a reference time signal so that all lockboxes are synchronizedin their operations and so that they will activate their receivers atthe same time every day.

By using such a radio updating approach, maintenance of lockbox and keydata is greatly facilitated and system performance is thus enhanced.

SYSTEM MANAGEMENT

Some large real estate boards have tens of thousands of lockboxes andkeys in their systems, so an integrated management system is virtuallyessential. In one embodiment of the invention, a multiuser, multitaskingsystem with large amounts of on-line storage is resident at the boardoffice and serves as board computer 18. A super microcomputer such asthe NCR Tower system is a suitable machine.

As shown in FIG. 21, a computer system for a large real estate boarddesirably includes a trunk interface unit 94 and a plurality oftelephone lines 96 to allow a plurality of remote stands 16b (not shown)to interface with the super microcomputer simultaneously. In thepreferred embodiment, up to eight telephone lines are used. Trunkinterface unit 94 thus allows super microcomputer 18 to be interrogatedover telephone lines (using DTMF tones) and allows data to be exchangedbetween the super microcomputer and individual lockbox and keycomponents via stands 16. In such capacity, stands 16 function as remoteinput/output ports for the board computer and the stands'microprocessors function as smart input/output controllers.

In the preferred embodiment, trunk interface unit 94 includes aninterface module 99 associated with each telephone line 96 fordecrypting incoming data and for encrypting outgoing data. Modules 99also desirably include speech synthesizers so that synthesized speechcorresponding to various computer data can be sent back to individualagents over the telephone lines. A ninth interface module 99, which doesnot include a speech synthesizer, is provided in trunk interface unit 94for interfacing with a local stand 16a resident at the board office.

Board computer system 18 also desirably includes at least one phone line98 and an associated data modem 97 for interfacing to smaller computers18 resident at individual agency offices.

In a typical large system, several smaller computers 18 are distributedthroughout the system. Normally, such smaller computers are limited toperforming certain preselected functions. For example, the softwareloaded into a small computer 18 at an individual agency typicallyenables it to update certain lockbox parameters, such as changing thelockout list and changing the daily disable times, but prevents it fromchanging more sensitive parameters, such as lockbox access codes.Similarly, the software loaded into the small computer 18 at the agencytypically enables it to deactivate keys, but prevents it fromreinitializing keys after they are deactivated and prevents it fromchanging key expiration dates and expired key access codes. Suchrestricted functions can only be performed by the central board computer

The board computer is used to keep track of all data pertinent to thesystem. Whenever a key or a lockbox is read or programmed, thecorresponding data is entered into a system database This databaseincludes information on all the features and parameters heretoforementioned, for every lockbox and key in the system. The board computercan search the database for any category of information and can generatecorresponding written reports on any such subject. By such reports, theboard can better target its activities. For example, the board cansearch the database to determine which listed properties have not beenshown often and then suggest to the member agencies that the advertisingof these properties be increased. Similarly, the board can monitormanpower trends and suggest staffing schedules that allocate agents tothe offices and at the times that the demand is greatest.

The above described system offers many advantages to real estate boardsthat span large territories. For example, keys 14 are usually programmedto expire occasionally and must be rejuvenated This is desirably done bythe real estate board, rather than by the individual agencies, so as tomaintain centralized control over key usage. Accordingly, as noted, mostsmall computers resident at the various agencies are not able torejuvenate expired keys. The agents could travel to the board officeperiodically to have their keys rejuvenated, but in large metropolitanareas this may be burdensome. The present system allows agents tocomplete all such transactions with the board computer over telephonelines. To rejuvenate an expired key, for example, the agent would placethe key on a stand 16 and would call the board computer. The key couldthen exchange appropriate handshaking signals with the computer andreceive from the computer the key characterization instructions neededto rejuvenate the key.

In addition to enabling the board computer to communicate with smalleragency computers, phone line 98 also permits the board computer tocommunicate with the vendor. Updated software can be reloaded using thislink. Other diagnostic routines, such as one for analyzing a diagnosticmaintenance log stored in a lockbox or a key, can be executed by thevendor on individual components by using this link to couple through theboard computer to the individual components at local board or agencyoffices.

The board computer includes several security features. For example, allrequests for service to the computer must include proper password codesbefore any transactions are allowed. Certain particularly sensitivetransactions may require that a user call the board computer, sendappropriate passwords and then hang up. The board computer then callsthe user back on a predetermined telephone line. By this and othertechniques, security of the system can be maintained even if thesecurity of the password codes is breached.

As will be recognized from the above discussion, the addition of acentralized board computer and its associated equipment greatlyincreases the system's utility and provides large real estate boardswith a versatile, comprehensive and integrated lockbox managementsystem.

Initialization and Deactivation of Lockboxes and Keys by the Computer

When the lockboxes and keys of the present invention are initiallyshipped from the vendor, they are not assigned to one particular realestate board. That is, the board identifying data portion of each unit'sRAM memory is left unprogrammed. This field is later programmedautomatically when the unit is initialized by a computer.

Both the lockboxes and the keys of the present invention include a bit,termed here the "free agent bit," in their respective RAM memories thatindicates whether the unit has been assigned to a particular board. Thisbit is initially set to "0" by the manufacturer, indicating that theunit is unassigned.

When the unit is received by the purchaser, it is placed on a stand andinitialized by an initialization routine run on a computer coupled tothe stand. One of the first operations performed by this initializationroutine is to determine the status of the unit's free agent bit. If itis found to be "0,"the routine automatically stores in the unit's RAMmemory a string of data identifying the board to which the computeritself is assigned. The computer then changes the unit's free agent bitfrom a "0" to a "1," thereby preventing subsequent changes of thelockbox's or key's board ownership. By this technique, every lockbox andkey is assigned automatically to the board to which the programmingcomputer is assigned.

After the lockbox or key is assigned to the initializing board, asdescribed above, the initialization routine in computer 18 continues byloading the unit's RAM memory with characterization instructions asspecified by the programming entity, usually the real estate board.

After a lockbox or key has been initialized, it can then only bereprogrammed by computers assigned to the same board. If it is desiredto transfer a lockbox or a key to a different board, the original ownermust deactivate the unit and change the unit's free agent bit back to"0."Thereafter, the unit will again assume the board ownership of thecomputer that reinitialized it.

Fraud Deterrence

The database in the board's central computer 18 includes dataidentifying each lockbox and key in the system and its operationalstatus (initialized, deactivated, etc.). This data is used by thecomputer to prevent keys from being fraudulently duplicated.

As noted, each key includes identification data indicating the key'sownership by agent, agency and board. Computer 18 will not load a keywith a set of identification data if it determines that a key havingthat particular set of identification data already exists. The systemthus prevents an unscrupulous user from reprogramming his or her key soas to fraudulently assume the identity of another agent in the board.The only way an unscrupulous agent could perpetrate this fraud would beto first obtain possession of the other agent's key and to deactivateit. This function, however, cannot generally be executed withoutknowledge of the other agent's personal code, which the unscrupulousagent should not know. Thus, it will be recognized that the database'stracking of data on each key in the system serves an important role indeterring fraud.

MECHANICAL CONSTRUCTION OF LOCKBOX

With reference to FIG. 3, lockbox 12 includes shackle 22, case 100 and ahinged key compartment door 24. Door 24 is retained in the closedposition by a cooperating door latch 102 and door stem 104. Door stem104 is shown in FIG. 6 as including a hook portion 106, a butt portion108 and a turned cut portion 110. Stem 104 is spring biased away fromthe back of case 100 by a spring 112 compressed between case 100 and ashoulder 114 on stem 104. Door stem 104 is retained in the lockingposition by the plungers 116, 118 of key compartment locking solenoids36 (FIG. 2) which engage stem 104 at turned cut portion 110 and limitits forward travel.

When it is desired to open door 24, the door is pressed inwardly. Thiscauses door stem 104 to move towards the rear of the case. This freedomof movement of stem 104 is provided by the length of turned cut portion110, which allows the stem to move inwardly while still engaged with theextended solenoid plungers.

After door stem 104 has been moved inwardly a distance, a retaining pin120 is urged against a pivoted lever 122. Lever 122 pivots about a pivotpoint 124 connected to the case, thereby causing the opposite end of thelever to exert a force against an actuator button 126 on microswitch 42.When microswitch 42 closes, key compartment locking solenoids 36energize, provided the appropriate authorization signals have beenexchanged between the lock and key.

When key compartment locking solenoids 36 energize, their plungers 116,118 retract. When the plungers retract, locking stem 104 is allowed totravel forwardly, no longer bound by the engagement of the plungers inthe turned cut portion of the stem. Thus, when the user releases thedoor, it is allowed to spring open, pushed by the force of stem spring112 and a compressed door gasket 192.

Forward travel of door stem 104 when in its unlocked condition islimited by the engagement of retaining pin 120 with a stopping portion126 of case 100. However, by the time door stem 104 has moved forwardlythis distance, door latch 102 has unhooked from stem 104 under theinfluence of door latch spring 128, which lifts latch 102 about a pivotpoint 130. Door 24 is thus free to open about door hinge 132, therebyallowing access to the house key or other materials stored in keycompartment 20.

Key compartment locking solenoids 36 return to their deenergized,locking states 0.25 seconds after microswitch 42 is reopened. Plungers116, 118 are then urged against a rear barrel portion 134 of stem 104 ifthe stem is then in its unlocked position.

When door 24 is closed, latch 102 engages with a hook portion of stem104 as these components are pushed inwardly. The hook portion of latch102 has a curved upper surface so that it lowers into its latchedposition automatically when it meets the case. The front entrance to thebore within which these coupled elements travel has a chamfered upperportion 135 to further facilitate lowering hook portion of latch 102into its locked position. With the latch and stem so engaged, stem 104is pushed further inwardly until the spring loaded plungers 116, 118 ofthe key compartment locking solenoids are able to engage into the turnedcut portion 110 of the stem. At this point, the door is locked. The dooris also rendered shock proof in this state by the positioning of thelatched components within the constraining bore which prevents thesecomponents from becoming disengaged.

Reviewing the key compartment access operation, it will be noted thatdoor 24 is positioned on the front of lockbox 12 and pivots downwardlyto expose the lockbox contents. This arrangement facilitates operationof lockboxes mounted in awkward locations, such as on ground level waterfaucets, especially when compared to prior art systems in which the keycontainer had to be released from the underside of the lockbox.Similarly, the present arrangement in which the key is coupled to thelockbox simply by bringing the key near the slot in the upper frontportion of the lockbox provides a substantial improvement in operatingflexibility over prior art systems in which the key had to be engagedwith the lockbox in a precise position and then manipulated while inthat position in order to operate the lockbox.

The use of a key compartment door 24 on the lockbox of the presentinvention also provides a variety of security enhancing features notfound in prior art lockboxes. For example, the shackle release mechanismof the present invention is concealed behind the key compartment door,thereby protecting it from vandalism and providing an additional measureof security to the shackle. Similarly, battery compartment retainingbolt 180 and tamper proof screws holding lockbox circuit board 182 andthe lockbox's rear cover in place are also protected from tampering bybeing positioned behind door 24.

Turning now to release of the shackle, FIGS. 2 and 7 show that shackle22 includes a loop portion 140 and two end portions 142. Each endportion includes a butt portion 144 and a turned cut portion 146.Shackle 22 is maintained in its locked position by a locking bar 148,shown in FIGS. 4 and 5. When in the locked position, turned cut portions146 in both ends of shackle 22 are engaged by circular notches 150 inlocking bar 148. Locking bar 148 is maintained in engagement with theturned cuts 146 of shackle 22 by the locking bar's own engagement on ashackle stem 162. Locking bar 148 is engaged on a butt portion 160 ofthe shackle stem by engagement between an elongated cut 164 in a flatportion 158 of the bar with a groove 166 in the butt portion of thestem. Shackle stem 162 is spring biased towards the front of the case bya spring 156 compressed between flat portion 158 of locking bar 148 andthe rear of the case. However, stem 162, and consequently locking bar148, are prevented from moving forwardly by the engagement of plungers168, 170 of shackle locking solenoids 38 with a turned cut portion 172in the stem.

It will be recognized that the above-described shackle lockingarrangement prevents any external force, regardless of how it isapplied, from imparting a load to shackle locking solenoids 38. Forexample, if it is attempted to pull locked shackle 22 out of case 100,locking bar 148 will lift slightly off shackle locking stem 162 and willimmediately engage a casting 152 (shown also in FIG. 8) in the upperportion of the case. (Casting 152 fills the upper portion of the caseand includes two openings 153 sized just to allow passage of the endportions 142 of the shackle). The force pulling shackle 22 from case 100is thus applied entirely against casting 152 and does not include anycomponent directed against solenoids 38.

Similarly, if it is attempted to push locked shackle 22 into case 100, apair of shoulders 154 on the lower portion of shackle 22 are immediatelyforced into engagement with a pair of protrusions 174 (FIG. 8) formed onthe top of case 100. (Shoulders 154 and protrusions 174 are obscured inFIGS. 2 and 3 by a plastic rain guard 175 formed around shackle 22). Theforce pushing shackle 22 into case 100 is thus applied entirely againstthe case 174 and again does not include any component directed againstshackle locking solenoids 38.

Even if the ends of shackle 22 are twisted, as may occur if a shacklecable (discussed below) is used, locking solenoids 38 are still isolatedfrom any load. Any twisting motion of the shackle ends simply causes theturned cut portions 146 of the shackle to turn harmlessly in thecircular notches 150 of locking bar 148.

If release of the shackle has been authorized, lockbox CPU 28 firstunlocks the key compartment door 24 to allow access to the shacklelocking stem 162 normally concealed behind this door. Shackle lockingsolenoids 38 are energized for eight seconds beginning two seconds afterdoor 24 is opened (as detected by microswitch 42). When plungers 168,170 of energized shackle locking solenoids 38 attempt to retract,however, they are prevented from doing so by their frictional engagementwith the edge of the turned cut portion 172 in shackle locking stem 162.This engagement is maintained by spring 156 which pushes the edge of theturned cut portion 172 of the stem against the sides of the solenoidplungers.

In order to release the shackle, the user must press shackle lockingstem 162 rearwardly a short distance so as to free plungers 168, 170from their frictional engagement with the edge of turned cut portion 172of the stem. When stem 162 is pressed rearwardly in this manner,energized solenoids 38 immediately retract their plungers from the stem.When the plungers retract, stem 62 is allowed to travel forwardly, nolonger bound by the plungers' engagement in the turned cut portion 172of the stem. Thus, when the user releases the stem, the stem is allowedto spring forwardly, pushed by the force of compressed spring 156.

When shackle stem 162 moves forwardly under the force of compressedspring 156, it causes the shackle locking bar 148, linked to the stem atbutt portion 160, to also move forwardly. This forward movement ofshackle locking bar 148 disengages the circular notches in the lockingbar from the turned cut portions 146 in the shackle. (Forward travel ofstem 162 and locking bar 148 is limited by the locking bar's engagementwith a stop member 159 formed in case 100). In this unlocked state, theshackle can then be freely withdrawn from the lockbox.

If shackle locking stem 162 is not pushed inwardly within eight seconds,locking solenoids 38 are deenergized, thereby relocking the stem, andconsequently the shackle, in place.

(It will be noted that the above described press-to-release mechanismsprovided on both the key compartment door and on the shackle lockingstem serve to remove all loads from the solenoids plungers when theseplungers are being retracted to their unlocked states. Consequently, thesolenoids employed in the present invention can be relatively small,thereby reducing both power drain and system cost.)

When it is desired to relock the shackle, the shackle is reinserted inopenings 153 in the top of case 100 and pressed downwardly untilshoulders 154 on the shackle engage the upper protrusions 174. Theshackle stem 162, which is protruding forwardly under the influence ofspring 156, is pressed inwardly by the user, thereby causing circularnotches 150 in locking bar 158 to move back into engagement with turnedcuts 146 in the shackle. Stem 162 can be pressed inwardly simply byclosing key compartment door 24. After the shackle stem has been pressedin a distance, plungers 168, 170 of shackle locking solenoids 38 springfrom their unlocked positions (pressing against the barrel portion 176of stem 162) back into the turned cut portion 172 of the stem. Thisaction relocks the shackle stem in its locked position andcorrespondingly locks shackle locking bar 148 in its lockingrelationship with shackle 22.

In addition to the lockbox security features already described, doorlocking stem 104 and shackle locking stem 162 also serve securityfunctions by rendering the inner workings of the lockbox inaccessible tovandalizing users. Once door 24 is opened, as for example by anauthorized user, the two bores in which these stems travel could providepassageways to the inner workings of the lockbox. A vandalizing user whois so inclined might attempt to tamper with the internal mechanismsthrough these passageways. In the present invention, however, suchtampering is thwarted by stems 104 and 162 which occlude thesepassageways so as to block all access to the inner workings of thelockbox.

Reviewing other mechanical components of the lockbox briefly, primarylockbox battery 32 comprises five alkaline AA cells mounted next to oneanother in a battery pack 178 mounted in the lower rear of the unit andheld in place by a bolt 180. An O-ring seal is provided around batterypack 178 and around the lockbox rear cover to prevent rain andcontaminants from entering the case. The backup battery 34 is mounted ona circuit board 182 in the back of the unit, which circuit board alsosupports the lockbox CPU 28, RAM 30 and related circuitry.

Communications coil 26 is mounted in the upper front of the lockbox,adjacent a receiving nest 184 into which the top end of key 14 isinserted. Coupling between communications coil 26 and key 14 through themetal lockbox case 100 is facilitated by a small slot 186 that extendsthrough case 100 for the length of coil 186. This slot is filled with aninsulating resin material that also pots the communications coil inplace.

Inside key compartment door 24 is a stainless steel liner 188 with a lipportion 190 that reinforces the door and helps retain the contents nearthe door as the door is being closed. Cellular urethane gaskets 192 arepositioned at the points where door 24 contacts the case so as toprevent rain and contaminants from entering the case. This cellularurethane material resists taking a set, thereby assuring a long life forthe door seals. An injection molded plastic bumper (not shown) can beprovided on the outside of the lockbox so as to protect the fixture towhich the lockbox is mounted (i.e. a door) from abrasion.

In alternative forms of the invention, shackle 22 can comprise a vinylclad steel cable terminated with appropriately machined ends, such asends 142 on shackle 22, so as to permit connection of the lockbox totrees and the like. The cable can again be provided with drip caps toprevent rain from entering the lockbox.

ALTERNATIVE ARRANGEMENT FOR COLLECTING LOCKBOX ACCESS LOG DATA

In still a further embodiment, a database of lockbox activity can becompiled at the boar office without resort to using the READ function onthe key. In this alternative embodiment, the key automatically readspart of the lockbox's access log each time a key and lockbox are engagedand the key stores this information in its memory.

During the pendency of the family of applications to which the presentapplication is related, Multacc, Inc. suggested that a lockbox key couldcollect data relating to transactions in which it is involved. Thisfeature, of course, had already been disclosed in this family ofapplications, viz., in the section entitled DIAGNOSTIC FEATURES whichdiscussed compilation of a maintenance log by the key. In the systemsuggested by Multacc, (hereinafter the "suggested system") after anumber of such transactions have been recorded in the key, the datawould be downloaded into a central database, as, for example, a databasemaintained by a real estate board. This downloading was suggested tooccur when the key memory reached its capacity or at predeterminedintervals, i.e. every thirty days.

In the presently claimed invention, when a key and lockbox are engaged,data about the current transaction (i.e. the date, time, keyidentification, lockbox identification and type of operation performed)is stored in the key memory, as well as data about the last severaltransactions that are recorded in the lockbox's access loo. The key'smemory is large enough to accumulate about 200 of these entries (whichmay be obtained, for example, after 66 key engagements with variouslockboxes if data about the two prior lockbox transactions and thecurrent transaction are stored in the key each time the key is engagedwith a lock).

The key can obviously not collect data from lockboxes indefinitely.Eventually, the access log data collected by a key must be downloaded tothe database if it is to be kept from being lost. In the preferredembodiment, this downloading must be done every fixed interval, such asat least once a month. A software routine in the key enforces thisrestriction and renders the key inoperative if it contains lockboxaccess log data that was gathered more than thirty days ago. Of course,the data from the key can be downloaded at the board office at any timewithin the thirty day period. In the preferred embodiment, after the keyis unloaded of this data, it is not required to dump its contents to theboard computer until thirty days after its next engagement with alockbox.

The software routine that enforces the 30 day restriction can beimplemented in a variety of ways. Most preferable is one in which thekey checks the date of the oldest lockbox transaction logged in itsmemory, every time the key is woken up, to see if that transactionoccurred more than 30 days ago. If such stale data is noted, the keydisplays a corresponding message on the LCD display and requests thatthe data be downloaded through a stand to the board computer. Until thedata is downloaded, the key is disabled from opening a lockbox.

By the above-described arrangement, the board office computer isprovided with a patchwork collection of lockbox access data. Obviously,much of the data is duplicated, since each key contains informationabout its own accesses, as well as information about several precedinglockbox transactions that may have involved other keys. This informationabout the several preceding lockbox transactions will likewise becarried by other keys, including the keys that made each of thepreceding transactions. The database manager at the board office candelete these duplicates from the file. A suitable database withduplicate deletion capabilities is the RBase database available fromMicrorim, Inc. of Redmond, Washington.

The foregoing arrangement is illustrated in FIGS. 22 and 23. FIG. 22illustrates the memory contents of two lockboxes (A and B) and threekeys (1, 2 and 3). Each lockbox memory contains an access log with anumber of entries. Each entry includes a lockbox identifier (i.e. A orB), a transaction number and associated transaction data (i.e. theidentity of the accessing key, the date and time of the access, etc).Each key memory contains excerpted sections from various lockboxmemories. For example, at one point key #1 was used to open lockbox A orwas otherwise coupled thereto. During this transaction, the lockboxtransferred data to the key about that transaction (number 102),together with data about the lockbox's prior two transactions (numbers100 and 101). This data was added to the memory in key #1.

Thereafter, key #2 was coupled to lockbox A. During this transaction,lockbox A transferred to key #2 not only data about their owntransaction (i.e. number 103), but also about the lockbox's prior twotransactions (numbers 101 and 102). Thus, it can be seen that data aboutlockbox A's transaction number 102 with key #1 was then carried by twokeys, #1 and #2.

Thereafter, key #3 was coupled to lockbox A and received data abouttheir own transaction (i.e. number 104) and about lockbox A's prior twotransactions (numbers 102 and 103). Thus, data about lockbox A'stransaction number 102 was then being carried by three keys, #1, #2 and#3.

In lockbox A's subsequent operations, data about transaction number 102is no longer provided to keys that data has scrolled out of the sectionof the lockbox access log that is transferred to interacting keys.

FIG. 23 illustrates a database into which the data automaticallycollected by keys #1-3 has been downloaded. As can be seen, data aboutcertain of lockbox A's transactions have been provided repeatedly to thedatabase. The duplicate entries can be deleted by the database and theremaining entries sorted to compile the access log for each lockbox inthe system.

The presently claimed invention provides several advantages over thetechnique suggested by Multacc. In the suggested Multacc system, if thekey becomes lost or if the agent otherwise does not download the key atthe board, the integrity of the database at the real estate board officewould be lost. Data about the lost key's activity would never becompiled by the board. The presently claimed invention, by contrast,requires that the key obtain information from the lockbox about at leastone prior lockbox transaction so that redundant data is provided to theboard computer. By this technique, the disappearance of a key does notnecessarily impair the integrity of the database. Data lost by thedisappearance of one key will be provided by others.

A related drawback of the suggested system is in the timeliness of thedata in the real estate board's database. Assuming that such a systemoperates on a thirty-day interval and all keys are downloaded asappropriate, then the data in the board database would be behind thecurrent date by thirty days. For example, if today is September 30, theboard would have incomplete data for transactions occurring after July31.

The presently claimed invention is similar in this respect. The databaseis complete only for transactions one month (or other chosen interval)or more past. However, since each lockbox transaction is reported to theboard database by two or three or more keys, chances are that the datafor a given lockbox transaction will be reported sooner to the databaseof the present invention than to the database of the suggested system.

Statistically speaking, if the 30 day expiration interval was randomlydistributed among the keys in the suggested system and if all of thekeys were appropriately downloaded into the data base, that databasewould have the following probabilities of containing data about aspecific lockbox transaction:

    ______________________________________                                        SUGGESTED SYSTEM                                                                             Probability Data                                               Date of Lockbox                                                                              Has Been Downloaded                                            Transaction    to Database                                                    ______________________________________                                        Aug. 28        100                                                            29             100                                                            30             100                                                            31             100                                                            Sept. 1        96.6                                                           2              93.3                                                           3              90.                                                            4              86.6                                                           5              83.3                                                           6              80                                                             7              76.6                                                           8              73.3                                                           9              70.                                                            10             66.6                                                           11             63.3                                                           12             60.                                                            13             56.6                                                           14             53.3                                                           15             50.                                                            16             46.6                                                           17             43.3                                                           18             40.                                                            19             36.6                                                           20             33.3                                                           21             30.                                                            22             26.6                                                           23             23.3                                                           24             20.                                                            25             16.6                                                           26             13.3                                                           27             10.                                                            28             6.6                                                            29             3.3                                                            30             0                                                              ______________________________________                                    

The probability for September 29, for example, is computed as: ##EQU1##the probability for Sept. 28 is computed as: ##EQU2##

In the presently claimed system, by contrast, assuming each key recordsdata about three transactions whenever it is coupled with a lock (i.e.the transaction in which one it is engaged plus the lockbox's twopreceding transactions), the data timeliness is greatly improved, asshown by the following chart.

    ______________________________________                                        PRESENT INVENTION                                                                            Probability Data                                               Date of Lockbox                                                                              Has Been Downloaded                                            Transaction    to Database                                                    ______________________________________                                        Aug. 28        100                                                            29             100                                                            30             100                                                            31             100                                                            Sept. 1        99.996                                                         2              99.97                                                          3              99.9                                                           4              99.8                                                           5              99.5                                                           6              99.2                                                           7              98.7                                                           8              98.1                                                           9              97.3                                                           10             96.3                                                           11             95.1                                                           12             93.6                                                           13             91.9                                                           14             89.8                                                           15             87.5                                                           16             84.6                                                           17             81.8                                                           18             78.4                                                           19             74.6                                                           20             70.4                                                           21             65.7                                                           22             60.6                                                           23             54.9                                                           24             48.8                                                           25             42.1                                                           26             34.9                                                           27             27.1                                                           28             18.7                                                           29             9.7                                                            30             0                                                              ______________________________________                                    

The probability for September 29, for example, is computed as: ##EQU3##the probability for September 28, is computed as: ##EQU4##

From the foregoing it can be recognized that higher degrees of dataintegrity are reached substantially sooner in the presently claimedinvention than in that suggested by Multacc. For example, the databasemaintained by the presently claimed invention provides a 95% chance ofhaving data about a lockbox transaction that occurred 19 days earlier.This 95% figure would not be achieved in the suggested Multacc systemexcept for transactions made 29 or more days earlier.

The timeliness of the data in the presently claimed invention can beincreased to an arbitrarily high degree by increasing the number ofprior lockbox transactions for which data is transferred to a key duringa transaction. For example, if data about the ten preceding lockboxtransactions is obtained by the key, there is a 95% chance that dataabout a transaction that occurred only 8 days ago will already be in thedatabase. This is in contrast to a corresponding probability of 27% inthe proposed Multacc system. In that system, only transactions 29 daysor more old would have a 95% probability of being recorded in thedatabase.

Having illustrated and described the principles of our invention withreference to a preferred embodiment and several variations thereof, itshould be apparent to those skilled in the art that the invention can bemodified in arrangement and detail without departing from suchprinciples. For example, although the system is described with referenceto a lockbox system for containing dwelling keys, it is readilyadaptable to other uses, such as in industrial security systems.Similarly, although the preferred embodiment has been described asincluding all the claimed features, other systems could readily bedesigned that include only some of these features and that include otherfeatures not here discussed. Accordingly, we claim as our invention allsuch modifications as may come within the spirit and scope of thefollowing claims and equivalents thereof.

We claim:
 1. An electronic lock system comprising:an electronic lock; anelectronic key; lock memory means in the lock for storing data relatingto prior interactions of the lock with keys; key memory means in the keyoperable without user intervention each time the key interacts with alock, for obtaining data from the lock relating to at least one priorinteraction of the lock with a key; a database; and means fordownloading data from the key memory means to the database.
 2. Theelectronic lock system of claim 1 which further comprises means forlimiting utility of the key if the data stored therein is notperiodically downloaded to the database.
 3. The electronic lock systemof claim 1 in which the key memory means additionally includes means forstoring data relating to the current key/lock interaction.
 4. Theelectronic lock system of claim 1 in which the key memory means includesmeans for obtaining data relating to some but not all prior interactionsof the lock with a key.
 5. A method of compiling data relating tooperation of an electronic locking system that includes locks and keys,comprising the steps:collecting data in the locks relating to systemoperation; transferring without user intervention a portion of a lock'scollected data to a key coupled thereto each time a key is coupled tothe lock, said portion including data relating to at least one prioroperation of the lock with a key; and periodically transferring saiddata from the key to a central database.
 6. The method of claim 5 whichfurther comprises the step of processing the data compiled in thedatabase to remove duplicate data therefrom.
 7. The method of claim 5which further comprises the step of limiting utility of the key if datais not transferred from the key to the database periodically.
 8. Amethod of compiling data operation of an electronic locking systemhaving a lock and a plurality of keys in which the lock has a memory foraccumulating transactional data, comprising the steps:transferring afirst dataset comprising transactional data about n preceding locktransactions from a lock to a first key, where n is greater than zero;transferring a second dataset comprising transactional data about npreceding lock transactions from said lock to a next, second key coupledthereto, said second data set having data about one transaction notincluded in the first dataset and said first dataset having data aboutone transaction not included in the second dataset; and transferringsaid first and second datasets to a database.
 9. The method of claim 8which further comprises the step of removing duplicate data from thedatabase.
 10. In a method of operating an electronic real estate lockboxsystem that includes an electronic key and an electronic lockbox, theelectronic key having a memory, an improvement comprising the steps:eachtime the key is involved in a first lockbox transaction, storing data inthe key memory relating to said first transaction without userintervention; each time the key is involved in a second lockboxtransaction, storing additional data in the key memory relating to saidsecond transaction without user intervention; and subsequentlydownloading the data relating to said first and second lockboxtransactions to a computer.
 11. A method of relaying lock/keytransactional data from the memory of at least one electronic lock to aremote database, said lock being operable with electronic keys that havememories for receiving data from the lock memory, the method comprisingthe steps:each time the lock is operated with a key, transferring datarelated to N prior lock/key transactions from the lock memory to the keymemory, where N is greater than 1; and transferring said data from thekey memory to a database; wherein data related to each lock/keyinteraction can potentially be relayed from the lock to the database byN different keys, thereby increasing reliability and reducing datalatency.